json-rest-api 1.0.28 → 2.0.0

package/tests/anyapi-custom-idproperty.test.js

@@ -1,163 +0,0 @@
-import { describe, it, before, beforeEach, after } from 'node:test'
-import assert from 'node:assert/strict'
-import knexLib from 'knex'
-import { Api } from 'hooked-api'
-
-import { RestApiPlugin, RestApiAnyapiKnexPlugin } from '../index.js'
-import { ensureAnyApiSchema } from '../plugins/core/lib/anyapi/schema-utils.js'
-import { storageMode } from './helpers/storage-mode.js'
-import {
-  createJsonApiDocument,
-  createRelationship,
-  resourceIdentifier,
-} from './helpers/test-utils.js'
-
-const maybeDescribe = storageMode.isAnyApi() ? describe : describe.skip
-
-maybeDescribe('AnyAPI custom idProperty', () => {
-  const knex = knexLib({
-    client: 'better-sqlite3',
-    connection: { filename: ':memory:' },
-    useNullAsDefault: true,
-  })
-
-  let api
-
-  before(async () => {
-    await ensureAnyApiSchema(knex)
-
-    api = new Api({ name: 'anyapi-custom-idproperty-test', log: { level: 'warn' } })
-    await api.use(RestApiPlugin, {
-      simplifiedApi: false,
-      simplifiedTransport: false,
-      returnRecordApi: {
-        post: 'full',
-        put: 'full',
-        patch: 'full',
-      },
-      sortableFields: ['id', 'owner_id', 'item_id', 'code', 'name', 'category'],
-      queryDefaultLimit: 20,
-      queryMaxLimit: 100,
-    })
-    await api.use(RestApiAnyapiKnexPlugin, { knex })
-
-    await api.addResource('owners', {
-      schema: {
-        owner_id: { type: 'id' },
-        name: { type: 'string', required: true },
-      },
-      idProperty: 'owner_id',
-      tableName: 'custom_id_owners',
-    })
-    await api.resources.owners.createKnexTable()
-
-    await api.addResource('items', {
-      schema: {
-        item_id: { type: 'id' },
-        code: { type: 'string', required: true, search: true },
-        name: { type: 'string', required: true },
-        category: { type: 'string', required: true },
-        owner_id: { type: 'id', belongsTo: 'owners', as: 'owner' },
-      },
-      idProperty: 'item_id',
-      tableName: 'custom_id_items',
-    })
-    await api.resources.items.createKnexTable()
-  })
-
-  after(async () => {
-    await api?.release()
-    await knex.destroy()
-  })
-
-  beforeEach(async () => {
-    await knex('any_links').delete()
-    await knex('any_records').delete()
-  })
-
-  it('uses logical ids for post, get, query, sparse fields, cursors, and includes', async () => {
-    const owner = await api.resources.owners.post({
-      inputRecord: createJsonApiDocument('owners', { name: 'Owner One' }),
-      simplified: false,
-    })
-
-    const itemInputs = [
-      { code: 'A001', name: 'Apple', category: 'Fruit' },
-      { code: 'A002', name: 'Apricot', category: 'Fruit' },
-      { code: 'B001', name: 'Broccoli', category: 'Vegetable' },
-      { code: 'C001', name: 'Carrot', category: 'Vegetable' },
-    ]
-
-    const createdItems = []
-    for (const item of itemInputs) {
-      const created = await api.resources.items.post({
-        inputRecord: createJsonApiDocument(
-          'items',
-          item,
-          { owner: createRelationship(resourceIdentifier('owners', owner.data.id)) }
-        ),
-        simplified: false,
-      })
-      createdItems.push(created)
-    }
-
-    const fetched = await api.resources.items.get({
-      id: createdItems[0].data.id,
-      queryParams: {
-        include: ['owner'],
-        fields: {
-          items: 'item_id,code,name,category',
-          owners: 'owner_id,name',
-        },
-      },
-      simplified: false,
-    })
-
-    assert.equal(fetched.data.id, createdItems[0].data.id)
-    assert.equal(fetched.data.attributes.code, 'A001')
-    assert.equal(fetched.data.attributes.name, 'Apple')
-    assert.equal(fetched.data.attributes.item_id, undefined)
-    assert.equal(fetched.included?.[0]?.type, 'owners')
-    assert.equal(fetched.included?.[0]?.id, owner.data.id)
-    assert.equal(fetched.included?.[0]?.attributes.owner_id, undefined)
-
-    const firstPage = await api.resources.items.query({
-      queryParams: {
-        include: ['owner'],
-        fields: {
-          items: 'item_id,code,name,category',
-          owners: 'owner_id,name',
-        },
-        sort: ['category', 'name'],
-        page: { size: 2 },
-      },
-      simplified: false,
-    })
-
-    assert.equal(firstPage.data.length, 2)
-    assert(firstPage.meta.pagination.cursor.next, 'first page should include a next cursor')
-    assert(firstPage.data.every((item) => item.attributes.item_id === undefined))
-    assert(firstPage.included?.some((entry) => entry.type === 'owners' && entry.id === owner.data.id))
-
-    const secondPage = await api.resources.items.query({
-      queryParams: {
-        include: ['owner'],
-        fields: {
-          items: 'item_id,code,name,category',
-          owners: 'owner_id,name',
-        },
-        sort: ['category', 'name'],
-        page: {
-          size: 2,
-          after: firstPage.meta.pagination.cursor.next,
-        },
-      },
-      simplified: false,
-    })
-
-    const firstIds = firstPage.data.map((item) => item.id)
-    const secondIds = secondPage.data.map((item) => item.id)
-    assert.equal(secondPage.data.length, 2)
-    assert(!secondIds.some((id) => firstIds.includes(id)), 'cursor page should not repeat records')
-  })
-})

package/tests/autofilter.test.js

@@ -1,463 +0,0 @@
-import { describe, it, before, after, beforeEach } from 'node:test'
-import assert from 'node:assert/strict'
-import knexLib from 'knex'
-import {
-  validateJsonApiStructure,
-  cleanTables,
-  createJsonApiDocument,
-  assertResourceAttributes,
-  createRelationship,
-  resourceIdentifier
-} from './helpers/test-utils.js'
-import { storageMode } from './helpers/storage-mode.js'
-import { createAutoFilterApi } from './fixtures/api-configs.js'
-
-const knex = knexLib({
-  client: 'better-sqlite3',
-  connection: {
-    filename: ':memory:'
-  },
-  useNullAsDefault: true
-})
-
-let api
-
-const scopedContext = (workspaceId, userId, projectId) => ({
-  scopeValues: {
-    workspaceId,
-    userId,
-    ...(projectId !== undefined ? { projectId } : {})
-  }
-})
-
-const moveTaskOutOfScope = async ({ taskId, workspaceId, userId }) => {
-  if (storageMode.isAnyApi()) {
-    const descriptor = await api.anyapi.registry.getDescriptor(api.anyapi.tenantId, 'tasks')
-    await knex('any_records')
-      .where({
-        id: Number(taskId),
-        tenant_id: api.anyapi.tenantId,
-        resource: 'tasks'
-      })
-      .update({
-        [descriptor.fields.workspace_id.slot]: workspaceId,
-        [descriptor.fields.user_id.slot]: userId
-      })
-    return
-  }
-
-  await knex('autofilter_tasks')
-    .where({ id: Number(taskId) })
-    .update({
-      workspace_id: workspaceId,
-      user_id: userId
-    })
-}
-
-describe('AutoFilter Plugin', () => {
-  before(async () => {
-    api = await createAutoFilterApi(knex)
-  })
-
-  after(async () => {
-    await knex.destroy()
-  })
-
-  beforeEach(async () => {
-    await cleanTables(knex, [
-      'autofilter_workspace_reports',
-      'autofilter_user_notes',
-      'autofilter_projects',
-      'autofilter_tasks',
-      'autofilter_optional_tasks',
-      'autofilter_system_settings'
-    ])
-  })
-
-  it('stamps workspace-scoped records and filters collections by workspace', async () => {
-    const reportA = await api.resources.workspace_reports.post({
-      inputRecord: createJsonApiDocument('workspace_reports', {
-        title: 'Workspace A report'
-      }),
-      simplified: false
-    }, scopedContext('workspace-a', 101))
-
-    await api.resources.workspace_reports.post({
-      inputRecord: createJsonApiDocument('workspace_reports', {
-        title: 'Workspace B report'
-      }),
-      simplified: false
-    }, scopedContext('workspace-b', 202))
-
-    validateJsonApiStructure(reportA)
-    assertResourceAttributes(reportA.data, {
-      title: 'Workspace A report',
-      workspace_id: 'workspace-a'
-    })
-
-    const queryA = await api.resources.workspace_reports.query({
-      simplified: false
-    }, scopedContext('workspace-a', 999))
-
-    validateJsonApiStructure(queryA, true)
-    assert.equal(queryA.data.length, 1)
-    assert.equal(queryA.data[0].attributes.title, 'Workspace A report')
-    assert.equal(queryA.data[0].attributes.workspace_id, 'workspace-a')
-  })
-
-  it('stamps user-scoped records and filters collections by user', async () => {
-    const noteA = await api.resources.user_notes.post({
-      inputRecord: createJsonApiDocument('user_notes', {
-        body: 'User 101 note'
-      }),
-      simplified: false
-    }, scopedContext('workspace-a', 101))
-
-    await api.resources.user_notes.post({
-      inputRecord: createJsonApiDocument('user_notes', {
-        body: 'User 202 note'
-      }),
-      simplified: false
-    }, scopedContext('workspace-a', 202))
-
-    validateJsonApiStructure(noteA)
-    assertResourceAttributes(noteA.data, {
-      body: 'User 101 note',
-      user_id: 101
-    })
-
-    const queryA = await api.resources.user_notes.query({
-      simplified: false
-    }, scopedContext('workspace-b', 101))
-
-    validateJsonApiStructure(queryA, true)
-    assert.equal(queryA.data.length, 1)
-    assert.equal(queryA.data[0].attributes.body, 'User 101 note')
-    assert.equal(queryA.data[0].attributes.user_id, 101)
-  })
-
-  it('applies composite workspace+user scoping', async () => {
-    const ownProject = await api.resources.projects.post({
-      inputRecord: createJsonApiDocument('projects', {
-        name: 'Workspace A / User 101'
-      }),
-      simplified: false
-    }, scopedContext('workspace-a', 101))
-
-    await api.resources.projects.post({
-      inputRecord: createJsonApiDocument('projects', {
-        name: 'Workspace A / User 202'
-      }),
-      simplified: false
-    }, scopedContext('workspace-a', 202))
-
-    await api.resources.projects.post({
-      inputRecord: createJsonApiDocument('projects', {
-        name: 'Workspace B / User 101'
-      }),
-      simplified: false
-    }, scopedContext('workspace-b', 101))
-
-    validateJsonApiStructure(ownProject)
-    assertResourceAttributes(ownProject.data, {
-      name: 'Workspace A / User 101',
-      workspace_id: 'workspace-a',
-      user_id: 101
-    })
-
-    const scopedQuery = await api.resources.projects.query({
-      simplified: false
-    }, scopedContext('workspace-a', 101))
-
-    validateJsonApiStructure(scopedQuery, true)
-    assert.equal(scopedQuery.data.length, 1)
-    assert.equal(scopedQuery.data[0].attributes.name, 'Workspace A / User 101')
-  })
-
-  it('treats public resources as unscoped', async () => {
-    const created = await api.resources.system_settings.post({
-      inputRecord: createJsonApiDocument('system_settings', {
-        key: 'app.version',
-        value: '1.0.0'
-      }),
-      simplified: false
-    })
-
-    validateJsonApiStructure(created)
-
-    const anonymousQuery = await api.resources.system_settings.query({
-      simplified: false
-    })
-    validateJsonApiStructure(anonymousQuery, true)
-    assert.equal(anonymousQuery.data.length, 1)
-
-    const scopedQuery = await api.resources.system_settings.query({
-      simplified: false
-    }, scopedContext('workspace-a', 101))
-    validateJsonApiStructure(scopedQuery, true)
-    assert.equal(scopedQuery.data.length, 1)
-  })
-
-  it('scopes single-record lookups so out-of-scope records are not found', async () => {
-    const project = await api.resources.projects.post({
-      inputRecord: createJsonApiDocument('projects', {
-        name: 'Scoped Project'
-      }),
-      simplified: false
-    }, scopedContext('workspace-a', 101))
-
-    await assert.rejects(
-      async () => {
-        await api.resources.projects.get({
-          id: project.data.id,
-          simplified: false
-        }, scopedContext('workspace-a', 202))
-      },
-      (error) => error.code === 'REST_API_RESOURCE',
-      'Out-of-scope records should behave as not found'
-    )
-  })
-
-  it('stamps scoped fields on PUT and rejects inconsistent scoped updates', async () => {
-    const project = await api.resources.projects.post({
-      inputRecord: createJsonApiDocument('projects', {
-        name: 'Original Project',
-        description: 'Original Description'
-      }),
-      simplified: false
-    }, scopedContext('workspace-a', 101))
-
-    await api.resources.projects.put({
-      inputRecord: {
-        data: {
-          type: 'projects',
-          id: project.data.id,
-          attributes: {
-            name: 'Updated Project',
-            description: 'Updated Description',
-            status: 'active'
-          }
-        }
-      },
-      simplified: false
-    }, scopedContext('workspace-a', 101))
-
-    const afterPut = await api.resources.projects.get({
-      id: project.data.id,
-      simplified: false
-    }, scopedContext('workspace-a', 101))
-
-    validateJsonApiStructure(afterPut)
-    assertResourceAttributes(afterPut.data, {
-      name: 'Updated Project',
-      description: 'Updated Description',
-      workspace_id: 'workspace-a',
-      user_id: 101
-    })
-
-    await assert.rejects(
-      async () => {
-        await api.resources.projects.patch({
-          id: project.data.id,
-          inputRecord: {
-            data: {
-              type: 'projects',
-              id: project.data.id,
-              attributes: {
-                workspace_id: 'workspace-b'
-              }
-            }
-          },
-          simplified: false
-        }, scopedContext('workspace-a', 101))
-      },
-      (error) => error.code === 'REST_API_VALIDATION',
-      'PATCH should reject inconsistent scope-field updates'
-    )
-  })
-
-  it('uses scoped lookups when validating relationships', async () => {
-    const projectA = await api.resources.projects.post({
-      inputRecord: createJsonApiDocument('projects', {
-        name: 'Project A'
-      }),
-      simplified: false
-    }, scopedContext('workspace-a', 101))
-
-    const projectB = await api.resources.projects.post({
-      inputRecord: createJsonApiDocument('projects', {
-        name: 'Project B'
-      }),
-      simplified: false
-    }, scopedContext('workspace-b', 101))
-
-    const task = await api.resources.tasks.post({
-      inputRecord: createJsonApiDocument('tasks',
-        {
-          title: 'Task A'
-        },
-        {
-          project: createRelationship(resourceIdentifier('projects', projectA.data.id))
-        }
-      ),
-      simplified: false
-    }, scopedContext('workspace-a', 101))
-
-    validateJsonApiStructure(task)
-    assertResourceAttributes(task.data, {
-      title: 'Task A',
-      workspace_id: 'workspace-a',
-      user_id: 101
-    })
-
-    await assert.rejects(
-      async () => {
-        await api.resources.tasks.post({
-          inputRecord: createJsonApiDocument('tasks',
-            {
-              title: 'Cross-scope Task'
-            },
-            {
-              project: createRelationship(resourceIdentifier('projects', projectB.data.id))
-            }
-          ),
-          simplified: false
-        }, scopedContext('workspace-a', 101))
-      },
-      (error) => error.code === 'REST_API_RESOURCE' || error.code === 'REST_API_VALIDATION',
-      'Relationship validation should respect scoped datasets'
-    )
-  })
-
-  it('scopes included resources through the same autofilter path as top-level queries', async () => {
-    const project = await api.resources.projects.post({
-      inputRecord: createJsonApiDocument('projects', {
-        name: 'Scoped include project'
-      }),
-      simplified: false
-    }, scopedContext('workspace-a', 101))
-
-    const visibleTask = await api.resources.tasks.post({
-      inputRecord: createJsonApiDocument('tasks',
-        {
-          title: 'Visible task'
-        },
-        {
-          project: createRelationship(resourceIdentifier('projects', project.data.id))
-        }
-      ),
-      simplified: false
-    }, scopedContext('workspace-a', 101))
-
-    const hiddenTask = await api.resources.tasks.post({
-      inputRecord: createJsonApiDocument('tasks',
-        {
-          title: 'Out-of-scope task'
-        },
-        {
-          project: createRelationship(resourceIdentifier('projects', project.data.id))
-        }
-      ),
-      simplified: false
-    }, scopedContext('workspace-a', 101))
-
-    await moveTaskOutOfScope({
-      taskId: hiddenTask.data.id,
-      workspaceId: 'workspace-b',
-      userId: 202
-    })
-
-    const result = await api.resources.projects.get({
-      id: project.data.id,
-      queryParams: {
-        include: ['tasks']
-      },
-      simplified: false
-    }, scopedContext('workspace-a', 101))
-
-    validateJsonApiStructure(result)
-    assert.deepEqual(result.data.relationships.tasks.data, [
-      resourceIdentifier('tasks', visibleTask.data.id)
-    ])
-    assert.equal(result.included?.length, 1)
-    assert.equal(result.included?.[0]?.id, visibleTask.data.id)
-    assert.equal(result.included?.[0]?.attributes.title, 'Visible task')
-  })
-
-  it('treats null belongsTo autofilter values as valid null linkage on writes', async () => {
-    const implicitNull = await api.resources.optional_tasks.post({
-      inputRecord: createJsonApiDocument('optional_tasks', {
-        title: 'Implicit null project'
-      }),
-      simplified: false
-    }, scopedContext('workspace-a', 101))
-
-    const explicitNull = await api.resources.optional_tasks.post({
-      inputRecord: createJsonApiDocument(
-        'optional_tasks',
-        {
-          title: 'Explicit null project'
-        },
-        {
-          project: { data: null }
-        }
-      ),
-      simplified: false
-    }, scopedContext('workspace-a', 101))
-
-    const implicitFetched = await api.resources.optional_tasks.get({
-      id: implicitNull.data.id,
-      simplified: false
-    }, scopedContext('workspace-a', 101))
-
-    const explicitFetched = await api.resources.optional_tasks.get({
-      id: explicitNull.data.id,
-      simplified: false
-    }, scopedContext('workspace-a', 101))
-
-    validateJsonApiStructure(implicitFetched)
-    validateJsonApiStructure(explicitFetched)
-    assert.equal(implicitFetched.data.relationships.project.data, null)
-    assert.equal(explicitFetched.data.relationships.project.data, null)
-  })
-
-  it('fails cleanly when a required autofilter value is missing', async () => {
-    await assert.rejects(
-      async () => {
-        await api.resources.projects.query({
-          simplified: false
-        })
-      },
-      (error) => error.code === 'REST_API_AUTOFILTER_CONTEXT',
-      'Scoped resources should require configured scope values'
-    )
-
-    await assert.rejects(
-      async () => {
-        await api.resources.projects.post({
-          inputRecord: createJsonApiDocument('projects', {
-            name: 'No Scope'
-          }),
-          simplified: false
-        })
-      },
-      (error) => error.code === 'REST_API_AUTOFILTER_CONTEXT',
-      'Scoped writes should require configured scope values'
-    )
-  })
-
-  it('exposes compiled preset configuration without auth semantics', () => {
-    assert.deepEqual(api.autofilter.getConfig(), {
-      presets: ['public', 'workspace', 'user', 'workspace_user'],
-      resolvers: ['workspace', 'user', 'currentProject']
-    })
-
-    assert.deepEqual(api.autofilter.getScopeConfig('projects'), {
-      preset: 'workspace_user',
-      filters: [
-        { field: 'workspace_id', resolver: 'workspace', required: true },
-        { field: 'user_id', resolver: 'user', required: true }
-      ]
-    })
-  })
-})