json-rest-api 1.0.29 → 2.1.0

package/plugins/core/rest-api-autofilter-plugin.js

@@ -1,4 +1,5 @@
 import { RestApiValidationError } from '../../lib/rest-api-errors.js'
+import { snapshotResourceConfiguration } from './lib/querying-writing/schema-helpers.js'
 import { createStorageAdapterUtilities } from './lib/querying/storage-adapter-utils.js'
 
 const PUBLIC_PRESET_NAME = 'public'
@@ -37,7 +38,7 @@ function buildAutofilterConsistencyError ({ filter, resolvedValue }) {
 }
 
 function ensureResolverMap (resolverMap = {}) {
-  const normalized = {}
+  const normalized = Object.create(null)
 
   for (const [name, resolver] of Object.entries(resolverMap)) {
     if (typeof resolver !== 'function') {
@@ -50,7 +51,7 @@ function ensureResolverMap (resolverMap = {}) {
 }
 
 function getPresetFilters (presetName, presets) {
-  const preset = presets[presetName]
+  const preset = Object.hasOwn(presets, presetName) ? presets[presetName] : undefined
 
   if (!preset) {
     throw new Error(`Unknown autofilter preset '${presetName}'.`)
@@ -77,7 +78,7 @@ function normalizeFilterDefinition ({ filterDef, resolvers, schemaStructure, sco
     throw new Error(`Autofilter definitions on resource '${scopeName}' must include a field.`)
   }
 
-  const fieldDef = schemaStructure[field]
+  const fieldDef = Object.hasOwn(schemaStructure, field) ? schemaStructure[field] : undefined
   if (!fieldDef) {
     throw new Error(`Autofilter field '${field}' does not exist on resource '${scopeName}'.`)
   }
@@ -91,7 +92,7 @@ function normalizeFilterDefinition ({ filterDef, resolvers, schemaStructure, sco
   let resolverName
 
   if (typeof resolverDef === 'string') {
-    resolve = resolvers[resolverDef]
+    resolve = Object.hasOwn(resolvers, resolverDef) ? resolvers[resolverDef] : undefined
     resolverName = resolverDef
     if (!resolve) {
       throw new Error(`Unknown autofilter resolver '${resolverDef}' on resource '${scopeName}'.`)
@@ -274,7 +275,7 @@ async function enforceScopedInput ({ compiledConfig, context, scopeName, injectM
 
 export const AutoFilterPlugin = {
   name: 'autofilter',
-  dependencies: ['rest-api', 'rest-api-knex|rest-api-anyapi-knex'],
+  dependencies: ['rest-api', ['rest-api-knex', 'rest-api-anyapi-knex']],
 
   install ({ api, addHook, vars, helpers, log, scopes, pluginOptions = {} }) {
     if (!api.knex?.instance) {
@@ -283,10 +284,10 @@ export const AutoFilterPlugin = {
 
     const state = {
       resolvers: ensureResolverMap(pluginOptions.resolvers || {}),
-      presets: {
+      presets: snapshotResourceConfiguration({
         [PUBLIC_PRESET_NAME]: { filters: [] },
         ...(pluginOptions.presets || {})
-      }
+      })
     }
 
     vars.autofilter = {
@@ -294,15 +295,12 @@ export const AutoFilterPlugin = {
       resolvers: Object.keys(state.resolvers)
     }
 
-    addHook('scope:added', 'compile-autofilter', {}, ({ context }) => {
-      const { scopeName, scopeOptions = {} } = context
-      const scope = scopes[scopeName]
-      const schemaStructure = scope?.vars?.schemaInfo?.schemaStructure || scopeOptions.schema || {}
-
-      scope.vars.autofilter = compileAutoFilterDefinition({
+    addHook('schema:compiled', 'compile-autofilter', {}, ({ context }) => {
+      const { scopeName, scopeOptions, schemaInfo } = context
+      schemaInfo.autofilter = compileAutoFilterDefinition({
         scopeName,
         scopeOptions,
-        schemaStructure,
+        schemaStructure: schemaInfo.schemaStructure,
         resolvers: state.resolvers,
         presets: state.presets
       })
@@ -312,7 +310,7 @@ export const AutoFilterPlugin = {
       const { query, tableName, scopeName } = context.knexQuery || {}
       if (!query || !scopeName) return
 
-      const compiledConfig = scopes[scopeName]?.vars?.autofilter
+      const compiledConfig = scopes[scopeName]?.vars?.schemaInfo?.autofilter
       if (!compiledConfig || compiledConfig.filters.length === 0) return
       const adapterUtils = createStorageAdapterUtilities({ context }, {
         getStorageAdapter: helpers.getStorageAdapter
@@ -345,7 +343,7 @@ export const AutoFilterPlugin = {
 
     addHook('beforeProcessingPost', 'autofilter-stamp-post', {}, async ({ context, scopeName }) => {
       await enforceScopedInput({
-        compiledConfig: scopes[scopeName]?.vars?.autofilter,
+        compiledConfig: scopes[scopeName]?.vars?.schemaInfo?.autofilter,
         context,
         scopeName,
         injectMissing: true,
@@ -359,7 +357,7 @@ export const AutoFilterPlugin = {
 
     addHook('beforeProcessingPut', 'autofilter-stamp-put', {}, async ({ context, scopeName }) => {
       await enforceScopedInput({
-        compiledConfig: scopes[scopeName]?.vars?.autofilter,
+        compiledConfig: scopes[scopeName]?.vars?.schemaInfo?.autofilter,
         context,
         scopeName,
         injectMissing: true,
@@ -373,7 +371,7 @@ export const AutoFilterPlugin = {
 
     addHook('beforeProcessingPatch', 'autofilter-validate-patch', {}, async ({ context, scopeName }) => {
       await enforceScopedInput({
-        compiledConfig: scopes[scopeName]?.vars?.autofilter,
+        compiledConfig: scopes[scopeName]?.vars?.schemaInfo?.autofilter,
         context,
         scopeName,
         injectMissing: false,
@@ -392,7 +390,7 @@ export const AutoFilterPlugin = {
       }),
 
       getScopeConfig: (scopeName) => {
-        const compiledConfig = scopes[scopeName]?.vars?.autofilter
+        const compiledConfig = scopes[scopeName]?.vars?.schemaInfo?.autofilter
         if (!compiledConfig) return null
 
         return {

package/plugins/core/rest-api-cors-plugin.js

@@ -1,237 +1,84 @@
+import { mergeResponseHeaders } from './connectors/lib/transport-http-helpers.js'
+
 export const CorsPlugin = {
   name: 'rest-api-cors',
   dependencies: ['rest-api'],
 
-  async install ({ api, addHook, vars, helpers, log, pluginOptions, runHooks }) {
-    // Get CORS configuration
-    const corsOptions = pluginOptions || {}
+  async install ({ api, addHook, vars, log, pluginOptions = {} }) {
+    if (!vars.transport) throw new Error('CorsPlugin requires an HTTP connector to be installed first')
 
-    // Store configuration - using a plain object for runtime updates
     const corsConfig = {
-      // Origin configuration
-      origin: corsOptions.origin || '*', // Can be string, regex, array, or function
-      credentials: corsOptions.credentials !== undefined ? corsOptions.credentials : true,
-
-      // Allowed methods
-      methods: corsOptions.methods || ['GET', 'POST', 'PUT', 'PATCH', 'DELETE', 'OPTIONS'],
-
-      // Allowed headers
-      allowedHeaders: corsOptions.allowedHeaders || [
-        'Content-Type',
-        'Authorization',
-        'X-Requested-With',
-        'X-HTTP-Method-Override',
-        'Accept',
-        'Origin'
-      ],
-
-      // Exposed headers (for client to read)
-      exposedHeaders: corsOptions.exposedHeaders || [
-        'X-Total-Count',
-        'X-Page-Count',
-        'Link',
-        'Location'
+      origin: pluginOptions.origin ?? '*',
+      credentials: pluginOptions.credentials ?? true,
+      methods: pluginOptions.methods ?? ['GET', 'POST', 'PUT', 'PATCH', 'DELETE', 'OPTIONS'],
+      allowedHeaders: pluginOptions.allowedHeaders ?? [
+        'Content-Type', 'Authorization', 'X-Requested-With', 'X-HTTP-Method-Override', 'Accept', 'Origin'
       ],
-
-      // Preflight cache
-      maxAge: corsOptions.maxAge || 86400, // 24 hours
-
-      // Options success status
-      optionsSuccessStatus: corsOptions.optionsSuccessStatus || 204
+      exposedHeaders: pluginOptions.exposedHeaders ?? ['X-Total-Count', 'X-Page-Count', 'Link', 'Location'],
+      maxAge: pluginOptions.maxAge ?? 86400,
+      optionsSuccessStatus: pluginOptions.optionsSuccessStatus ?? 204
     }
-
-    // Store reference in vars for access in hooks
     vars.cors = corsConfig
+    const originDecision = Symbol('corsOriginDecision')
 
-    // Helper to check if origin is allowed
-    function isOriginAllowed (origin, allowedOrigin) {
-      if (!origin) return !corsConfig.credentials // No origin = same-origin request
-
-      // String match
-      if (typeof allowedOrigin === 'string') {
-        return allowedOrigin === '*' || allowedOrigin === origin
-      }
-
-      // Regex match
-      if (allowedOrigin instanceof RegExp) {
-        return allowedOrigin.test(origin)
-      }
-
-      // Array of allowed origins
+    async function isOriginAllowed (origin, allowedOrigin) {
+      if (!origin) return allowedOrigin === '*' && !corsConfig.credentials
+      if (typeof allowedOrigin === 'string') return allowedOrigin === '*' || allowedOrigin === origin
+      if (allowedOrigin instanceof RegExp) return new RegExp(allowedOrigin.source, allowedOrigin.flags).test(origin)
       if (Array.isArray(allowedOrigin)) {
-        return allowedOrigin.some(allowed => isOriginAllowed(origin, allowed))
-      }
-
-      // Function check
-      if (typeof allowedOrigin === 'function') {
-        return allowedOrigin(origin)
+        for (const candidate of allowedOrigin) if (await isOriginAllowed(origin, candidate)) return true
+        return false
       }
-
+      if (typeof allowedOrigin === 'function') return !!(await allowedOrigin(origin))
       return false
     }
 
-    // Check if transport plugin is available
-    if (!vars.transport) {
-      log.error('CORS plugin requires a transport plugin (express, koa, etc.) to be installed')
-      return
+    async function allowRequestOrigin (context) {
+      if (!(originDecision in context)) {
+        // If the predicate throws, the error response must not retry or grant access.
+        context[originDecision] = false
+        context[originDecision] = await isOriginAllowed(context.transport.request.headers?.origin, corsConfig.origin)
+      }
+      return context[originDecision]
     }
 
-    // Register OPTIONS handler for all routes
-    const optionsHandler = async ({ context, headers }) => {
-      const origin = headers?.origin
-
-      log.debug('CORS OPTIONS request', { origin })
-
-      // Check if origin is allowed
-      if (isOriginAllowed(origin, corsConfig.origin)) {
-        const responseHeaders = {
-          'Access-Control-Allow-Methods': corsConfig.methods.join(', '),
-          'Access-Control-Allow-Headers': corsConfig.allowedHeaders.join(', '),
-          'Access-Control-Max-Age': String(corsConfig.maxAge)
-        }
-
-        // Set origin header
-        if (corsConfig.origin === '*' && !corsConfig.credentials) {
-          responseHeaders['Access-Control-Allow-Origin'] = '*'
-        } else if (origin) {
-          responseHeaders['Access-Control-Allow-Origin'] = origin
-          responseHeaders['Vary'] = 'Origin'
-        }
-
-        // Set credentials if enabled
-        if (corsConfig.credentials) {
-          responseHeaders['Access-Control-Allow-Credentials'] = 'true'
+    await api.addRoute({
+      method: 'OPTIONS',
+      path: vars.transport.matchAll,
+      handler: async ({ context }) => {
+        if (!await allowRequestOrigin(context)) {
+          return {
+            statusCode: 403,
+            body: { errors: [{ status: '403', title: 'Forbidden', detail: 'CORS origin not allowed' }] }
+          }
         }
-
         return {
           statusCode: corsConfig.optionsSuccessStatus,
-          headers: responseHeaders,
+          headers: {
+            'Access-Control-Allow-Methods': corsConfig.methods.join(', '),
+            'Access-Control-Allow-Headers': corsConfig.allowedHeaders.join(', '),
+            'Access-Control-Max-Age': String(corsConfig.maxAge)
+          },
           body: null
         }
-      } else {
-        // Origin not allowed
-        log.warn('CORS origin not allowed', { origin })
-        return {
-          statusCode: 403,
-          body: { error: 'CORS origin not allowed' }
-        }
       }
-    }
-
-    // Register OPTIONS route for all paths
-    await api.addRoute({
-      method: 'OPTIONS',
-      path: vars.transport.matchAll,
-      handler: optionsHandler
     })
 
-    // Hook to handle CORS headers for all responses
-    addHook('transport:response', 'cors-headers', { order: -1000 }, async ({ context }) => {
-      // Transport data is now nested in context
+    addHook('transport:response', 'cors-headers', {}, async ({ context }) => {
       const { request, response } = context.transport || {}
+      if (!request || !response) return
 
-      if (!request) {
-        log.error('CORS: request is undefined in transport:response hook')
-        return
-      }
-
-      const origin = request.headers?.origin
-      const method = request.method?.toUpperCase()
+      const wildcard = corsConfig.origin === '*' && !corsConfig.credentials
+      // Responses without a matching Origin must also have the correct cache key.
+      if (!wildcard) response.headers = mergeResponseHeaders(response.headers, { vary: 'Origin' })
+      if (!await allowRequestOrigin(context)) return
 
-      log.debug('CORS processing response', {
-        origin,
-        method,
-        path: request.path
-      })
-
-      // Skip if this was an OPTIONS request (already handled by route)
-      if (method === 'OPTIONS') {
-        return
-      }
-
-      // Check if origin is allowed
-      if (isOriginAllowed(origin, corsConfig.origin)) {
-        // Set origin header
-        if (corsConfig.origin === '*' && !corsConfig.credentials) {
-          response.headers['Access-Control-Allow-Origin'] = '*'
-        } else if (origin) {
-          response.headers['Access-Control-Allow-Origin'] = origin
-          response.headers['Vary'] = 'Origin'
-        }
-
-        // Set credentials if enabled
-        if (corsConfig.credentials) {
-          response.headers['Access-Control-Allow-Credentials'] = 'true'
-        }
-
-        // Set exposed headers
-        if (corsConfig.exposedHeaders.length > 0) {
-          response.headers['Access-Control-Expose-Headers'] = corsConfig.exposedHeaders.join(', ')
-        }
-      } else if (origin) {
-        // Origin not allowed - don't set any CORS headers
-        log.warn('CORS origin not allowed for response', {
-          origin,
-          allowedOrigins: corsConfig.origin
-        })
-      }
+      const headers = { 'Access-Control-Allow-Origin': wildcard ? '*' : request.headers.origin }
+      if (corsConfig.credentials) headers['Access-Control-Allow-Credentials'] = 'true'
+      if (corsConfig.exposedHeaders.length) headers['Access-Control-Expose-Headers'] = corsConfig.exposedHeaders.join(', ')
+      response.headers = mergeResponseHeaders(response.headers, headers)
     })
 
-    log.info('CORS plugin installed', {
-      origin: corsConfig.origin,
-      credentials: corsConfig.credentials,
-      methods: corsConfig.methods
-    })
+    log.info('CORS plugin installed', { origin: corsConfig.origin, credentials: corsConfig.credentials, methods: corsConfig.methods })
   }
 }
-
-/*
-  Usage examples:
-
-  // Basic usage - allow all origins
-  await api.use(CorsPlugin);
-
-  // Specific origin
-  await api.use(CorsPlugin, {
-    'rest-api-cors': {
-      origin: 'https://app.example.com'
-    }
-  });
-
-  // Multiple origins
-  await api.use(CorsPlugin, {
-    'rest-api-cors': {
-      origin: ['https://app.example.com', 'https://admin.example.com']
-    }
-  });
-
-  // Dynamic origin with regex
-  await api.use(CorsPlugin, {
-    'rest-api-cors': {
-      origin: /^https:\/\/.*\.example\.com$/
-    }
-  });
-
-  // Function-based origin check
-  await api.use(CorsPlugin, {
-    'rest-api-cors': {
-      origin: (origin) => {
-        // Custom logic to determine if origin is allowed
-        return myAllowedOrigins.includes(origin);
-      }
-    }
-  });
-
-  // Full configuration
-  await api.use(CorsPlugin, {
-    'rest-api-cors': {
-      origin: 'https://app.example.com',
-      credentials: true,
-      methods: ['GET', 'POST', 'PATCH', 'DELETE'],
-      allowedHeaders: ['Content-Type', 'Authorization', 'X-Custom-Header'],
-      exposedHeaders: ['X-Total-Count', 'X-RateLimit-Remaining'],
-      maxAge: 3600 // 1 hour
-    }
-  });
-
-*/