json-rest-api 1.0.27 → 1.0.29

package/plugins/core/lib/querying/knex-relationship-includes.js

@@ -90,9 +90,20 @@ import {
   getIdColumn as getStorageIdColumn,
   getStorageColumn as getMappedStorageColumn,
 } from '../storage/storage-mapping.js'
+import { createStorageAdapter } from '../storage/storage-adapter.js'
 
 const getScopeStorageAdapter = (scopes, scopeName) => scopes[scopeName]?.vars?.storageAdapter || null
 
+const resolveScopeStorageAdapter = (scopes, scopeName, knex) => {
+  const configuredAdapter = getScopeStorageAdapter(scopes, scopeName)
+  if (configuredAdapter) return configuredAdapter
+
+  const schemaInfo = scopes[scopeName]?.vars?.schemaInfo
+  if (!schemaInfo) return null
+
+  return createStorageAdapter({ knex, schemaInfo })
+}
+
 const getIdColumnForScope = (scopes, scopeName) => {
   const adapter = getScopeStorageAdapter(scopes, scopeName)
   if (adapter?.getIdColumn) {
@@ -162,7 +173,7 @@ const applyScopeFiltersToIncludeQuery = async ({
     return { query }
   }
 
-  const storageAdapter = scopeObject.vars.storageAdapter
+  const storageAdapter = resolveScopeStorageAdapter(scopes, scopeName, db)
 
   const queryState = await scopeObject.applyQueryFilters({
     query,
@@ -503,7 +514,7 @@ export const loadBelongsTo = async (scope, deps) => {
     const targetIdColumn = getIdColumnForScope(scopes, targetScope)
     // Build field selection for sparse fieldsets
     const targetScopeObject = scopes[targetScope]
-    const storageAdapter = targetScopeObject.vars.storageAdapter
+    const storageAdapter = resolveScopeStorageAdapter(scopes, targetScope, knex)
     const fieldSelectionInfo = fields?.[targetScope]
       ? await buildFieldSelection(targetScopeObject, {
         context: {
@@ -745,7 +756,7 @@ export const loadHasMany = async (scope, deps) => {
 
       // Step 3: Build field selection for sparse fieldsets
       const targetScopeObject = scopes[targetScope]
-      const storageAdapter = targetScopeObject.vars.storageAdapter
+      const storageAdapter = resolveScopeStorageAdapter(scopes, targetScope, knex)
       const targetIdColumn = getIdColumnForScope(scopes, targetScope)
       const fieldSelectionInfo = fields?.[targetScope]
         ? await buildFieldSelection(targetScopeObject, {
@@ -974,7 +985,7 @@ export const loadHasMany = async (scope, deps) => {
 
       // Build field selection for sparse fieldsets
       const targetScopeObject = scopes[targetScope]
-      const storageAdapter = targetScopeObject.vars.storageAdapter
+      const storageAdapter = resolveScopeStorageAdapter(scopes, targetScope, knex)
       const fieldSelectionInfo = fields?.[targetScope]
         ? await buildFieldSelection(targetScopeObject, {
           context: {
@@ -1224,7 +1235,7 @@ export const loadHasOne = async (scope, deps) => {
 
   // Build query for hasOne - expects single result per parent
   const targetScopeObject = scopes[targetScope]
-  const storageAdapter = targetScopeObject.vars.storageAdapter
+  const storageAdapter = resolveScopeStorageAdapter(scopes, targetScope, knex)
 
   // Build field selection for sparse fieldsets
   const fieldSelectionInfo = fields?.[targetScope]
@@ -1396,7 +1407,7 @@ export const loadPolymorphicBelongsTo = async (scope, deps) => {
 
       // Build field selection for sparse fieldsets
       const targetScopeObject = scopes[targetType]
-      const storageAdapter = targetScopeObject.vars.storageAdapter
+      const storageAdapter = resolveScopeStorageAdapter(scopes, targetType, knex)
       const fieldSelectionInfo = fields?.[targetType]
         ? await buildFieldSelection(targetScopeObject, {
           context: {
@@ -1624,7 +1635,7 @@ export const loadReversePolymorphic = async (scope, deps) => {
 
     // Build field selection for sparse fieldsets
     const targetScopeObject = scopes[targetScope]
-    const storageAdapter = targetScopeObject.vars.storageAdapter
+    const storageAdapter = resolveScopeStorageAdapter(scopes, targetScope, knex)
     const targetIdColumn = getIdColumnForScope(scopes, targetScope)
     const fieldSelectionInfo = fields?.[targetScope]
       ? await buildFieldSelection(targetScopeObject, {

package/plugins/core/lib/querying/query-field-sort-helpers.js

@@ -1,9 +1,55 @@
 import { normalizeStableSort, parseSortEntry } from './sort-helpers.js'
+import { RestApiValidationError } from '../../../../lib/rest-api-errors.js'
+import { createSchema } from 'json-rest-schema'
+import { normalizeValueForDatabaseStorage } from '../querying-writing/database-value-normalizers.js'
+
+export const validateCursorValues = (descriptors, cursorValues, parameter) => {
+  const validated = Object.create(null)
+  for (const { field, definition = {}, isRelationship } of descriptors) {
+    if (!Object.hasOwn(cursorValues, field)) continue
+    const value = cursorValues[field]
+    // Public resource IDs may be opaque strings, even when the storage schema
+    // uses the numeric id type for ordinary attributes.
+    const type = field === 'id' || isRelationship || definition?.type === 'id'
+      ? 'string'
+      : definition?.type
+    if (!type) {
+      validated[field] = value
+      continue
+    }
+    const contract = createSchema({
+      value: {
+        type,
+        noTrim: true,
+        nullable: field !== 'id',
+        ...(definition?.temporalPrecision !== undefined
+          ? { temporalPrecision: definition.temporalPrecision }
+          : {})
+      }
+    })
+    const { validatedObject, errors } = contract.patch({ value })
+    if (Object.keys(errors).length > 0 || (field === 'id' && !String(value ?? '').trim())) {
+      const path = `page.${parameter}`
+      throw new RestApiValidationError(`Invalid cursor value for sort field '${field}'.`, {
+        fields: [path],
+        violations: [{ field: path, rule: 'invalid_cursor_value', message: `Invalid ${type} value for '${field}'.` }]
+      })
+    }
+    validated[field] = validatedObject.value
+  }
+  return validated
+}
 
 export const getEffectiveSortableFields = (vars = {}) => {
-  const baseSortableFields = Array.isArray(vars.sortableFields)
+  const schema = vars.schemaInfo?.schemaStructure || {}
+  const baseSortableFields = Array.isArray(vars.sortableFields) && vars.sortableFields.length > 0
     ? vars.sortableFields
-    : []
+    : ['id', ...Object.keys(schema).filter((field) => {
+        const definition = schema[field]
+        return !definition.hidden && !definition.virtual && !definition.computed && !definition.belongsToPolymorphic
+      }), ...Object.entries(vars.schemaInfo?.searchSchemaStructure || {})
+        .filter(([, definition]) => definition.isRelationship && schema[definition.actualField]?.hidden !== true)
+        .map(([field]) => field)]
   const queryFieldSortableFields = Object.entries(vars.queryFields || {})
     .filter(([, fieldDef]) => fieldDef?.sortable === true)
     .map(([fieldName]) => fieldName)
@@ -29,15 +75,37 @@ export const buildEffectiveSortList = (sort, { defaultSort, idField = 'id' } = {
   return normalizeStableSort(sortList.length > 0 ? sortList : [idField], { idField })
 }
 
-export const applyQueryFieldOrder = (query, queryFieldRuntime, direction) => {
+export const applyQueryFieldOrder = (query, queryFieldRuntime, direction, nulls = 'last') => {
+  query.orderByRaw(`(${queryFieldRuntime.sql}) IS NULL ${nulls === 'last' ? 'ASC' : 'DESC'}`, queryFieldRuntime.bindings)
   query.orderByRaw(`(${queryFieldRuntime.sql}) ${direction}`, queryFieldRuntime.bindings)
 }
 
 export const applyQueryFieldPredicate = (builder, queryFieldRuntime, operator, value) => {
-  builder.whereRaw(`(${queryFieldRuntime.sql}) ${operator} ?`, [...queryFieldRuntime.bindings, value])
+  const definition = queryFieldRuntime.definition || {}
+  const normalizedValue = normalizeValueForDatabaseStorage(value, definition.type, {
+    temporalPrecision: definition.temporalPrecision
+  })
+  builder.whereRaw(`(${queryFieldRuntime.sql}) ${operator} ?`, [...queryFieldRuntime.bindings, normalizedValue])
 }
 
-export const applySortDescriptorPredicate = (builder, descriptor, operator, value, applyPlainPredicate) => {
+export const applySortDescriptorPredicate = (builder, descriptor, operator, value, applyPlainPredicate, includeNull = false) => {
+  if (includeNull) {
+    return builder.where(function () {
+      applySortDescriptorPredicate(this, descriptor, operator, value, applyPlainPredicate)
+      if (descriptor.queryFieldRuntime) {
+        this.orWhereRaw(`(${descriptor.queryFieldRuntime.sql}) IS NULL`, descriptor.queryFieldRuntime.bindings)
+      } else {
+        this.orWhereNull(descriptor.column)
+      }
+    })
+  }
+  if (value === null) {
+    const isNotNull = operator === 'IS NOT NULL'
+    if (descriptor.queryFieldRuntime) {
+      return builder.whereRaw(`(${descriptor.queryFieldRuntime.sql}) IS ${isNotNull ? 'NOT ' : ''}NULL`, descriptor.queryFieldRuntime.bindings)
+    }
+    return isNotNull ? builder.whereNotNull(descriptor.column) : builder.whereNull(descriptor.column)
+  }
   if (descriptor?.queryFieldRuntime) {
     return applyQueryFieldPredicate(builder, descriptor.queryFieldRuntime, operator, value)
   }
@@ -62,19 +130,27 @@ export const buildCursorPredicateChains = (
 
     if (cursorValue === undefined) {
       onMissingValue?.(descriptor.field)
-      return
+      throw new RestApiValidationError(`Cursor is missing a value for sort field '${descriptor.field}'.`, {
+        fields: [descriptor.field],
+        violations: [{
+          field: descriptor.field,
+          rule: 'missing_cursor_value',
+          message: 'Cursor must include every sort field.'
+        }]
+      })
     }
 
+    const operator = operatorSelector(descriptor.direction)
+    const forward = operator === (descriptor.direction.toUpperCase() === 'DESC' ? '<' : '>')
+    // Nulls sort last. There are no values after null at this sort position,
+    // but later tie breakers can still advance within the null group.
+    if (cursorValue === null && forward) return
+
     const chain = []
     for (let i = 0; i < index; i += 1) {
       const previousDescriptor = descriptors[i]
       const previousValue = cursorValues?.[previousDescriptor.field]
 
-      if (previousValue === undefined) {
-        onMissingValue?.(previousDescriptor.field)
-        return
-      }
-
       chain.push({
         descriptor: previousDescriptor,
         operator: '=',
@@ -84,8 +160,9 @@ export const buildCursorPredicateChains = (
 
     chain.push({
       descriptor,
-      operator: operatorSelector(descriptor.direction),
-      value: cursorValue
+      operator: cursorValue === null ? 'IS NOT NULL' : operator,
+      value: cursorValue,
+      includeNull: cursorValue !== null && forward
     })
 
     predicateChains.push(chain)
@@ -116,13 +193,14 @@ export const applyCursorPredicate = (
   query.where(function () {
     predicateChains.forEach((chain) => {
       this.orWhere(function () {
-        chain.forEach(({ descriptor, operator, value }) => {
+        chain.forEach(({ descriptor, operator, value, includeNull }) => {
           applySortDescriptorPredicate(
             this,
             descriptor,
             operator,
             value,
-            applyPlainPredicate
+            applyPlainPredicate,
+            includeNull
           )
         })
       })

package/plugins/core/lib/querying/sort-helpers.js

@@ -1,6 +1,13 @@
 export function normalizeStableSort (sort = [], { idField = 'id' } = {}) {
+  const seenFields = new Set()
   const sortList = Array.isArray(sort)
-    ? sort.filter((entry) => typeof entry === 'string' && entry.trim())
+    ? sort.filter((entry) => {
+      if (typeof entry !== 'string' || !entry.trim()) return false
+      const field = entry.startsWith('-') ? entry.slice(1) : entry
+      if (seenFields.has(field)) return false
+      seenFields.add(field)
+      return true
+    })
     : []
 
   if (sortList.length === 0) {