json-rest-api 1.0.25 → 1.0.26

package/docs/GUIDE/GUIDE_X_Row_Policies.md

@@ -204,6 +204,8 @@ column('id', { scopeName: 'users', alias: 'visible_users' })
 column('status', { alias: null }) // translated but deliberately unqualified
 ```
 
+The active resource's default qualifier and storage adapter are fixed when the policy hook begins. Calling `column()` later from a Knex grouping callback therefore still targets the table or alias of that query, even after the surrounding hook has returned. This applies to normal Knex and AnyAPI queries. A `scopeName` option resolves that target resource through the storage registry; use the explicit `alias` option only when the policy itself introduces another query alias.
+
 `value()` accepts the same `scopeName` option:
 
 ```js

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "json-rest-api",
-  "version": "1.0.25",
+  "version": "1.0.26",
   "main": "index.js",
   "type": "module",
   "scripts": {

package/plugins/core/lib/anyapi/query/anyapi-query-adapter.js

@@ -71,14 +71,6 @@ const SELECT_METHODS = new Set(['select', 'columns', 'distinct'])
 
 const AGGREGATE_METHODS = new Set(['count', 'min', 'max', 'sum', 'avg'])
 
-const CALLBACK_FIRST_METHODS = new Set([
-  'where',
-  'andWhere',
-  'orWhere',
-  'having',
-  'orHaving',
-])
-
 const isFunction = (value) => typeof value === 'function'
 const isObject = (value) => value && typeof value === 'object' && !Array.isArray(value)
 
@@ -149,13 +141,6 @@ const translateJoinObject = (adapter, obj) => {
   return result
 }
 
-const maybeWrapCallback = (adapter, callback) => {
-  if (!isFunction(callback)) return callback
-  return function wrappedCallback (...args) {
-    return callback.apply(adapter.proxy, args)
-  }
-}
-
 const isRaw = (value) => Boolean(value && typeof value === 'object' && typeof value.toSQL === 'function' && value.toSQL().method)
 
 const ensureArray = (value) => (Array.isArray(value) ? value : [value])
@@ -317,12 +302,39 @@ export class AnyapiQueryAdapter {
     this.aliasActualNames.set(alias, alias)
   }
 
-  #translateWhereArgs (method, args) {
+  #wrapQueryCallback (callback) {
+    if (!isFunction(callback)) return callback
+    const adapter = this
+
+    return function wrappedCallback (...args) {
+      const callbackTarget = this
+      const callbackProxy = adapter.#createProxy(callbackTarget)
+      const callbackArgs = args.map((arg) => arg === callbackTarget ? callbackProxy : arg)
+      return callback.apply(callbackProxy, callbackArgs)
+    }
+  }
+
+  #wrapJoinCallback (callback) {
+    if (!isFunction(callback)) return callback
+    const adapter = this
+
+    return function wrappedCallback (...args) {
+      const callbackTarget = this
+      const callbackProxy = adapter.#createJoinProxy(callbackTarget)
+      const callbackArgs = args.map((arg) => arg === callbackTarget ? callbackProxy : arg)
+      return callback.apply(callbackProxy, callbackArgs)
+    }
+  }
+
+  #translateWhereArgs (args, { joinClause = false } = {}) {
     if (args.length === 0) return args
     const [first, ...rest] = args
 
     if (isFunction(first)) {
-      return [maybeWrapCallback(this, first), ...rest]
+      const wrappedGroup = joinClause
+        ? this.#wrapJoinCallback(first)
+        : this.#wrapQueryCallback(first)
+      return [wrappedGroup, ...rest]
     }
 
     if (isObject(first) && !isRaw(first)) {
@@ -337,7 +349,7 @@ export class AnyapiQueryAdapter {
 
     if (rest.length > 0 && isFunction(rest[rest.length - 1])) {
       const newRest = [...rest]
-      newRest[newRest.length - 1] = maybeWrapCallback(this, rest[rest.length - 1])
+      newRest[newRest.length - 1] = this.#wrapQueryCallback(rest[rest.length - 1])
       return [translatedFirst, ...newRest]
     }
 
@@ -350,7 +362,7 @@ export class AnyapiQueryAdapter {
     const translatedColumn = this.translateColumn(column)
 
     if (isFunction(values)) {
-      return [translatedColumn, maybeWrapCallback(this, values), ...rest]
+      return [translatedColumn, this.#wrapQueryCallback(values), ...rest]
     }
 
     return [translatedColumn, values, ...rest]
@@ -439,7 +451,7 @@ export class AnyapiQueryAdapter {
     const [first, ...rest] = args
 
     if (isFunction(first)) {
-      return [maybeWrapCallback(this, first), ...rest]
+      return [this.#wrapJoinCallback(first), ...rest]
     }
 
     if (isObject(first) && !isRaw(first)) {
@@ -454,7 +466,7 @@ export class AnyapiQueryAdapter {
 
     const translatedRest = rest.map((value, index) => {
       if (isFunction(value)) {
-        return maybeWrapCallback(this, value)
+        return this.#wrapJoinCallback(value)
       }
       if (typeof value !== 'string') {
         return value
@@ -475,7 +487,7 @@ export class AnyapiQueryAdapter {
     const translatedColumn = typeof column === 'string' ? this.translateColumn(column) : column
 
     if (isFunction(values)) {
-      return [translatedColumn, maybeWrapCallback(this, values), ...rest]
+      return [translatedColumn, this.#wrapQueryCallback(values), ...rest]
     }
 
     return [translatedColumn, values, ...rest]
@@ -510,7 +522,7 @@ export class AnyapiQueryAdapter {
           let translatedArgs = args
 
           if (WHERE_METHODS.has(prop)) {
-            translatedArgs = adapter.#translateWhereArgs(prop, args)
+            translatedArgs = adapter.#translateWhereArgs(args, { joinClause: true })
           } else if (WHERE_IN_METHODS.has(prop)) {
             translatedArgs = adapter.#translateWhereInArgs(args)
           } else if (BETWEEN_METHODS.has(prop)) {
@@ -607,7 +619,7 @@ export class AnyapiQueryAdapter {
           let translatedArgs = args
 
           if (WHERE_METHODS.has(prop)) {
-            translatedArgs = adapter.#translateWhereArgs(prop, args)
+            translatedArgs = adapter.#translateWhereArgs(args)
           } else if (WHERE_IN_METHODS.has(prop)) {
             translatedArgs = adapter.#translateWhereInArgs(args)
           } else if (BETWEEN_METHODS.has(prop)) {
@@ -630,8 +642,6 @@ export class AnyapiQueryAdapter {
             translatedArgs = adapter.#translateSelectArgs(args)
           } else if (AGGREGATE_METHODS.has(prop)) {
             translatedArgs = adapter.#translateAggregateArgs(args)
-          } else if (CALLBACK_FIRST_METHODS.has(prop) && args.length && isFunction(args[0])) {
-            translatedArgs = [maybeWrapCallback(adapter, args[0]), ...args.slice(1)]
           }
 
           const result = value.apply(target, translatedArgs)

package/plugins/core/lib/querying/storage-adapter-utils.js

@@ -1,5 +1,9 @@
 export const createStorageAdapterUtilities = (hookParams, { getStorageAdapter } = {}) => {
   const context = hookParams?.context || {}
+  const activeQuery = context.knexQuery || {}
+  const activeScopeName = activeQuery.scopeName
+  const activeTableName = activeQuery.tableName
+  const activeStorageAdapter = activeQuery.storageAdapter || context.storageAdapter
   const storageCache = new Map()
 
   const fetchStorageAdapter = (scopeName) => {
@@ -7,13 +11,9 @@ export const createStorageAdapterUtilities = (hookParams, { getStorageAdapter }
     if (storageCache.has(scopeName)) return storageCache.get(scopeName)
 
     let adapter = null
-    if (scopeName === context?.knexQuery?.scopeName) {
-      adapter = context.storageAdapter ||
-        context.knexQuery?.storageAdapter ||
+    if (scopeName === activeScopeName) {
+      adapter = activeStorageAdapter ||
         (typeof getStorageAdapter === 'function' ? getStorageAdapter(scopeName) : null)
-      if (adapter && !context.storageAdapter) {
-        context.storageAdapter = adapter
-      }
     } else {
       adapter = typeof getStorageAdapter === 'function' ? getStorageAdapter(scopeName) : null
     }
@@ -23,8 +23,8 @@ export const createStorageAdapterUtilities = (hookParams, { getStorageAdapter }
   }
 
   const defaultAliasForScope = (scopeName) => {
-    if (scopeName === context?.knexQuery?.scopeName) {
-      return context.knexQuery?.tableName || scopeName
+    if (scopeName === activeScopeName) {
+      return activeTableName || scopeName
     }
     return scopeName
   }

package/tests/fixtures/api-configs.js

@@ -1,5 +1,6 @@
 import { Api } from 'hooked-api'
 import {
+  AutoFilterPlugin,
   FileHandlingPlugin,
   QueryProjectionsPlugin,
   RestApiAnyapiKnexPlugin,
@@ -1733,21 +1734,38 @@ export async function createRowPolicyApi (knex, pluginOptions = {}) {
           return false
         }
 
-        query.whereIn(
-          column('access_group'),
-          groups.map((group) => value('access_group', group))
-        )
+        query.where(function visibilityGrants () {
+          this.whereRaw('1 = 0')
+          this.orWhere(function groupVisibilityGrant () {
+            this.whereIn(
+              column('access_group'),
+              groups.map((group) => value('access_group', group))
+            )
+          })
+        })
         return true
       },
       ...(rowPolicyOptions.policies || {})
     }
   })
 
+  await api.use(AutoFilterPlugin, {
+    resolvers: {
+      workspace: ({ context }) => context.scopeValues?.workspaceId
+    },
+    presets: {
+      workspace: {
+        filters: [{ field: 'workspace_id', resolver: 'workspace' }]
+      }
+    }
+  })
+
   await api.addResource('policy_projects', {
     schema: {
       id: { type: 'id' },
       name: { type: 'string', required: true, max: 200 },
-      access_group: { type: 'string', required: true }
+      access_group: { type: 'string', required: true },
+      workspace_id: { type: 'string', required: true }
     },
     relationships: {
       tasks: { type: 'hasMany', target: 'policy_tasks', foreignKey: 'project_id' },
@@ -1759,6 +1777,7 @@ export async function createRowPolicyApi (knex, pluginOptions = {}) {
         otherKey: 'task_id'
       }
     },
+    autofilter: 'workspace',
     rowPolicy: 'groupVisibility',
     tableName: 'row_policy_projects'
   })
@@ -1770,6 +1789,7 @@ export async function createRowPolicyApi (knex, pluginOptions = {}) {
       id: { type: 'id' },
       title: { type: 'string', required: true, max: 200, search: true },
       access_group: { type: 'string', required: true },
+      workspace_id: { type: 'string', required: true },
       project_id: {
         type: 'number',
         nullable: true,
@@ -1787,6 +1807,7 @@ export async function createRowPolicyApi (knex, pluginOptions = {}) {
         otherKey: 'project_id'
       }
     },
+    autofilter: 'workspace',
     rowPolicy: 'groupVisibility',
     tableName: 'row_policy_tasks'
   })

package/tests/row-policy.test.js

@@ -11,6 +11,7 @@ import {
 } from './helpers/test-utils.js'
 import { storageMode } from './helpers/storage-mode.js'
 import { createRowPolicyApi } from './fixtures/api-configs.js'
+import { createStorageAdapterUtilities } from '../plugins/core/lib/querying/storage-adapter-utils.js'
 
 const knex = knexLib({
   client: 'better-sqlite3',
@@ -23,17 +24,23 @@ const knex = knexLib({
 let api
 const policyEvents = []
 
-const adminContext = () => ({ visibility: { all: true } })
-const groupContext = (...groups) => ({ visibility: { groups } })
+const adminContext = (workspaceId = 'workspace-a') => ({
+  visibility: { all: true },
+  scopeValues: { workspaceId }
+})
+const groupContext = (...groups) => ({
+  visibility: { groups },
+  scopeValues: { workspaceId: 'workspace-a' }
+})
 
-const postProject = async (name, accessGroup) => {
+const postProject = async (name, accessGroup, context = adminContext()) => {
   return api.resources.policy_projects.post({
     inputRecord: createJsonApiDocument('policy_projects', {
       name,
       access_group: accessGroup
     }),
     simplified: false
-  }, adminContext())
+  }, context)
 }
 
 const postTask = async ({ title, accessGroup, projectId, context = adminContext() }) => {
@@ -53,6 +60,39 @@ const postTask = async ({ title, accessGroup, projectId, context = adminContext(
 }
 
 describe('RowPolicy Plugin', () => {
+  it('keeps active query translation stable after the hook context is restored', () => {
+    const queryStorageAdapter = {
+      translateColumn: (field) => field === 'id' ? 'record_id' : field
+    }
+    const ambientStorageAdapter = {
+      translateColumn: (field) => field === 'id' ? 'wrong_id' : field
+    }
+    const context = {
+      knexQuery: {
+        scopeName: 'organisationUnits',
+        tableName: 'organisation_units',
+        storageAdapter: queryStorageAdapter
+      },
+      storageAdapter: ambientStorageAdapter
+    }
+    const utilities = createStorageAdapterUtilities({ context })
+
+    delete context.knexQuery
+    delete context.storageAdapter
+
+    assert.equal(
+      utilities.translateColumn('organisationUnits', 'id'),
+      'organisation_units.record_id'
+    )
+    assert.equal(
+      utilities.translateColumn('organisationUnits', 'id', 'visible_units'),
+      'visible_units.record_id'
+    )
+    assert.equal(utilities.defaultAliasForScope('users'), 'users')
+    assert.equal(Object.hasOwn(context, 'knexQuery'), false)
+    assert.equal(Object.hasOwn(context, 'storageAdapter'), false)
+  })
+
   before(async () => {
     api = await createRowPolicyApi(knex, {
       onPolicy: (event) => policyEvents.push(event)
@@ -73,7 +113,7 @@ describe('RowPolicy Plugin', () => {
     ])
   })
 
-  it('applies visibility before offset pagination and counts the same dataset', async () => {
+  it('applies deferred grouped visibility before offset pagination and counts the same dataset', async () => {
     await postProject('Allowed 1', 'group-a')
     await postProject('Hidden 1', 'group-b')
     await postProject('Allowed 2', 'group-a')
@@ -112,6 +152,22 @@ describe('RowPolicy Plugin', () => {
     )
   })
 
+  it('combines row policy visibility with the resource autofilter', async () => {
+    await postProject('Visible', 'group-a')
+    await postProject('Wrong group', 'group-b')
+    await postProject('Wrong workspace', 'group-a', adminContext('workspace-b'))
+
+    const result = await api.resources.policy_projects.query({
+      queryParams: { sort: ['id'] },
+      simplified: false
+    }, groupContext('group-a'))
+
+    assert.deepEqual(
+      result.data.map((record) => record.attributes.name),
+      ['Visible']
+    )
+  })
+
   it('keeps cursor pagination inside the visible dataset', async () => {
     await postProject('Allowed 1', 'group-a')
     await postProject('Hidden 1', 'group-b')
@@ -404,7 +460,7 @@ describe('RowPolicy Plugin', () => {
     const result = await api.resources.policy_projects.query({
       queryParams: { page: { number: 1, size: 10 } },
       simplified: false
-    })
+    }, { scopeValues: { workspaceId: 'workspace-a' } })
 
     assert.deepEqual(result.data, [])
     assert.equal(result.meta.pagination.total, 0)