json-rest-api 3.0.0-rc.0 → 3.0.0

package/plugins/core/lib/storage/ordinary-data-helpers.js

@@ -9,6 +9,7 @@ import { toJsonApiRecordWithBelongsTo } from '../querying-writing/knex-json-api-
 import { processIncludes } from '../querying/knex-process-includes.js'
 import { loadRelationshipIdentifiers } from '../querying/relationship-identifiers.js'
 import { applyQueryConstraint } from '../querying/query-constraint.js'
+import { deleteFoundRow, foundRow, lockFoundRow, updateFoundRow } from './single-row-writes.js'
 import { runAggregateQuery } from '../querying/aggregate-query.js'
 import { RestApiResourceError } from '../../../../lib/rest-api-errors.js'
 import { getOperationDiagnosticContext } from '../../../../lib/error-context.js'
@@ -19,6 +20,7 @@ import { getUrlPrefix } from '../querying/url-helpers.js'
 import { unwrapQueryBuilderState, withQueryFilteringContext } from '../querying/query-builder-utils.js'
 import { serializeJsonApiQuery } from '../querying-writing/connectors-query-parser.js'
 import { applyDatabaseReadOptions, databaseIdentityExpression } from '../querying-writing/database-value-normalizers.js'
+import { whereInIdentifiers } from '../querying/identifier-query.js'
 
 /**
  * Every update advances the resource's lock version by one, whatever the input says.
@@ -192,7 +194,7 @@ export function createOrdinaryDataHelpers ({ api, scopes, knex, log, getScopeSto
   }
 
   /** @type {OrdinaryDataReadHelpers['dataGet']} */
-  const dataGet = async ({ scopeName, context }) => {
+  const dataGet = async ({ scopeName, context, runHooks, scoped = false }) => {
     const storageAdapter = getScopeStorageAdapter(scopeName)
     context.storageAdapter = storageAdapter
     const scope = getScope(scopeName)
@@ -207,15 +209,32 @@ export function createOrdinaryDataHelpers ({ api, scopes, knex, log, getScopeSto
     // Enrichment removes fetched dependencies that the caller did not request.
     context.computedDependencies = fieldSelectionInfo.computedDependencies
 
-    // The preceding minimal read has already applied permission and row filters.
-    let query = db(tableName).where(idProperty, id)
+    // The preceding minimal read has already applied permission and row filters,
+    // unless the read is `scoped`: then it applies them itself, as the only read.
+    let query = db(tableName).where(scoped ? `${tableName}.${idProperty}` : idProperty, id)
+    if (scoped) {
+      const filterHooks = runHooks
+      if (!filterHooks) throw new Error('A scoped read needs runHooks')
+      query = (await withQueryFilteringContext(context, {
+        query,
+        filters: context.queryParams?.filters,
+        schemaInfo: context.schemaInfo,
+        scopeName,
+        tableName,
+        db,
+        queryPurpose: 'single',
+        adapter: storageAdapter,
+        storageAdapter
+      }, () => filterHooks('knexQueryFiltering'))).query
+    }
 
     const selectionState = await applyFieldSelectionToQuery({
       query,
       scope,
       fieldSelectionInfo,
       tableName,
-      useTablePrefix: false,
+      // A row policy may join tables, so a scoped read names its columns' table.
+      useTablePrefix: scoped,
       storageAdapter,
       db,
       context,
@@ -250,7 +269,7 @@ export function createOrdinaryDataHelpers ({ api, scopes, knex, log, getScopeSto
     return buildJsonApiResponse(scope, records, included, true, scopeName, context)
   }
 
-  // Supplying ids returns minimal records for the caller's bounded validation batch.
+  // Supplying ids returns minimal records for all of them, in one statement.
   /** @overload @param {DataMinimalRequest & { ids: Array<string | number> }} request @returns {Promise<DataResource[]>} */
   /** @overload @param {DataMinimalRequest & { ids?: undefined, context: DataReadContext & {id: string | number} }} request @returns {Promise<DataResource | null>} */
   /** @param {DataMinimalRequest & { ids?: Array<string | number> }} request */
@@ -273,11 +292,12 @@ export function createOrdinaryDataHelpers ({ api, scopes, knex, log, getScopeSto
 
     log.debug(`[Knex] GET_MINIMAL ${tableName}/${id}`)
 
-    // Knex types exclude unknown bindings; the configured driver still validates serializer results.
+    const table = db(tableName)
+    // whereInIdentifiers returns the builder it was given, which modify's types lose.
     let query = ids === undefined
-      ? db(tableName).where(idProperty, id)
-      : db(tableName).whereIn(idProperty, /** @type {import('knex').Knex.Value[]} */ (ids.map(value => storageAdapter.translateFilterValue('id', value))))
-        .distinct(`${tableName}.${idProperty}`)
+      ? table.where(idProperty, id)
+      : /** @type {typeof table} */ (table.modify(whereInIdentifiers, idProperty, ids.map(value => storageAdapter.translateFilterValue('id', value))))
+          .distinct(`${tableName}.${idProperty}`)
 
     if (typeof applyQueryFilters === 'function') {
       const scopedQueryState = await applyQueryFilters({
@@ -313,7 +333,7 @@ export function createOrdinaryDataHelpers ({ api, scopes, knex, log, getScopeSto
       return [field === 'id' ? 'id' : column, databaseIdentityExpression(db, `${tableName}.${column}`)]
     }))
     if (ids !== undefined) {
-      // Filtering owns predicates; the validation batch owns its identity projection.
+      // Filtering owns predicates; the id list owns its identity projection.
       query.clearSelect().distinct(`${tableName}.${idProperty}`)
       // Deduplicate policy joins by ID, without comparing JSON or other row values.
       /** @type {StorageRow[]} */
@@ -447,12 +467,10 @@ export function createOrdinaryDataHelpers ({ api, scopes, knex, log, getScopeSto
         // Calculate pagination metadata with total
         context.returnMeta.paginationMeta = calculatePaginationMeta(total, page, pageSize)
       } else {
-        // Without count, we can still provide basic pagination info
-        context.returnMeta.paginationMeta = {
-          page,
-          pageSize
-          // No total, pageCount, or hasMore when counts are disabled
-        }
+        // Without a count, the page's one extra row answers hasMore.
+        const hasMore = records.length > pageSize
+        if (hasMore) records.pop()
+        context.returnMeta.paginationMeta = { page, pageSize, hasMore }
       }
 
       // Generate links
@@ -623,29 +641,11 @@ export function createOrdinaryDataHelpers ({ api, scopes, knex, log, getScopeSto
       return
     }
 
-    const exists = await db(tableName)
-      .where(idProperty, id)
-      .first()
-
-    if (!exists) {
-      throw new RestApiResourceError(
-        'Resource not found',
-        {
-          subtype: ERROR_SUBTYPES.NOT_FOUND,
-          resourceType: scopeName,
-          resourceId: id
-        }
-      )
-    }
-
     // Updates cannot replace the primary key.
     delete finalAttributes[idProperty]
     advanceLockVersion(finalAttributes, context, storageAdapter, db)
-    if (Object.keys(finalAttributes).length > 0) {
-      await db(tableName)
-        .where(idProperty, id)
-        .update(finalAttributes)
-    }
+    const row = foundRow({ byId: () => db(tableName).where(`${tableName}.${idProperty}`, id), context, scopeName, storageAdapter, tableName })
+    await updateFoundRow(row, { db, scopeName, id, idColumn: `${tableName}.${idProperty}`, values: finalAttributes })
   }
 
   /** @type {OrdinaryDataWriteHelpers['dataPatch']} */
@@ -660,22 +660,6 @@ export function createOrdinaryDataHelpers ({ api, scopes, knex, log, getScopeSto
 
     log.debug(`[Knex] PATCH ${tableName}/${id}`)
 
-    // Check if record exists
-    const exists = await db(tableName)
-      .where(idProperty, id)
-      .first()
-
-    if (!exists) {
-      throw new RestApiResourceError(
-        'Resource not found',
-        {
-          subtype: ERROR_SUBTYPES.NOT_FOUND,
-          resourceType: scopeName,
-          resourceId: id
-        }
-      )
-    }
-
     // Core has already merged relationship values and applied setters.
     const attributes = inputRecord.data.attributes || {}
 
@@ -691,12 +675,8 @@ export function createOrdinaryDataHelpers ({ api, scopes, knex, log, getScopeSto
     delete finalAttributes[idProperty]
     advanceLockVersion(finalAttributes, context, storageAdapter, db)
 
-    // Update only if there are changes
-    if (Object.keys(finalAttributes).length > 0) {
-      await db(tableName)
-        .where(idProperty, id)
-        .update(finalAttributes)
-    }
+    const row = foundRow({ byId: () => db(tableName).where(`${tableName}.${idProperty}`, id), context, scopeName, storageAdapter, tableName })
+    await updateFoundRow(row, { db, scopeName, id, idColumn: `${tableName}.${idProperty}`, values: finalAttributes })
   }
 
   /** @type {OrdinaryDataWriteHelpers['dataDelete']} */
@@ -711,36 +691,24 @@ export function createOrdinaryDataHelpers ({ api, scopes, knex, log, getScopeSto
 
     log.debug(`[Knex] DELETE ${tableName}/${id}`)
 
-    // Check if record exists
-    const exists = await db(tableName)
-      .where(idProperty, id)
-      .first()
-
-    if (!exists) {
-      throw new RestApiResourceError(
-        'Resource not found',
-        {
-          subtype: ERROR_SUBTYPES.NOT_FOUND,
-          resourceType: scopeName,
-          resourceId: id
-        }
-      )
-    }
-
-    // Delete the record
-    await invalidateDeletedPivotTargets(api, scopeName, context)
-    await db(tableName)
-      .where(idProperty, id)
-      .delete()
+    const row = foundRow({ byId: () => db(tableName).where(`${tableName}.${idProperty}`, id), context, scopeName, storageAdapter, tableName })
+    // Before the DELETE: an ON DELETE CASCADE would remove the links that tell which parents to advance.
+    await invalidateDeletedPivotTargets(api, scopeName, context, () => lockFoundRow(row, { scopeName, id, idColumn: `${tableName}.${idProperty}` }))
+    await deleteFoundRow(row, { scopeName, id })
     await deletePivotReferences(api, scopeName, context)
 
     return { success: true }
   }
 
+  // A get with no reader of the minimal record reads once, scoped.
+  /** @type {NonNullable<OrdinaryDataReadHelpers['dataGetScoped']>} */
+  const dataGetScoped = ({ scopeName, context, runHooks }) => dataGet({ scopeName, context, runHooks, scoped: true })
+
   return {
     dataRelatedIdsQuery,
     dataExists,
     dataGet,
+    dataGetScoped,
     dataQuery,
     dataAggregate,
     dataPost,

package/plugins/core/lib/storage/single-row-writes.js

@@ -0,0 +1,71 @@
+// @ts-check
+// Single patch, put and delete find their row with a scoped read first, on
+// table and AnyAPI storage alike. Their UPDATE or DELETE repeats the owner that
+// read recorded, and its own row count tells whether the row has gone or moved
+// to another owner since.
+import { RestApiResourceError } from '../../../../lib/rest-api-errors.js'
+import { ERROR_SUBTYPES } from '../querying-writing/knex-constants.js'
+import { applyWriteConditions } from '../querying/query-constraint.js'
+import { countsMatchedRows } from './many-row-data-helpers.js'
+
+/**
+ * @param {string} scopeName
+ * @param {string | number} id
+ */
+const resourceNotFound = (scopeName, id) => new RestApiResourceError('Resource not found', {
+  subtype: ERROR_SUBTYPES.NOT_FOUND,
+  resourceType: scopeName,
+  resourceId: id
+})
+
+/**
+ * The row a single write found with its scoped read: `byId` looks it up, and
+ * the owner that read recorded is added, so a row that has gone or moved to
+ * another owner since is not matched.
+ * @param {{ byId: () => any, context: any, scopeName: string, storageAdapter: import('./storage-types.js').StorageAdapter, tableName: string }} target
+ * @returns {() => any}
+ */
+export const foundRow = ({ byId, context, scopeName, storageAdapter, tableName }) => () =>
+  applyWriteConditions({ query: byId(), context, scopeName, storageAdapter, tableName })
+
+/**
+ * Locks the row a single write found; not found when it has gone or moved.
+ * @param {() => any} row
+ * @param {{ scopeName: string, id: string | number, idColumn: string }} target
+ */
+export async function lockFoundRow (row, { scopeName, id, idColumn }) {
+  if (!await row().select(idColumn).forUpdate().first()) throw resourceNotFound(scopeName, id)
+}
+
+/**
+ * Updates the row a single write found, or, with nothing stored to change,
+ * locks it. Not found when it has gone or moved.
+ * @param {() => any} row
+ * @param {{ db: any, scopeName: string, id: string | number, idColumn: string, values: Record<string, unknown> }} update
+ * @returns {Promise<number>} The rows the UPDATE counted
+ */
+export async function updateFoundRow (row, { db, scopeName, id, idColumn, values }) {
+  if (!Object.keys(values).length) {
+    await lockFoundRow(row, { scopeName, id, idColumn })
+    return 0
+  }
+  const counted = await row().update(values)
+  if (counted) return counted
+  // MySQL without FOUND_ROWS counts the rows an UPDATE changed: an unchanged row counts zero.
+  if (await countsMatchedRows(db)) throw resourceNotFound(scopeName, id)
+  await lockFoundRow(row, { scopeName, id, idColumn })
+  return 0
+}
+
+/**
+ * Deletes the row a single write found. A DELETE counts the rows it removed,
+ * FOUND_ROWS or not; not found when it is gone.
+ * @param {() => any} row
+ * @param {{ scopeName: string, id: string | number }} target
+ * @returns {Promise<number>}
+ */
+export async function deleteFoundRow (row, { scopeName, id }) {
+  const deleted = await row().delete()
+  if (!deleted) throw resourceNotFound(scopeName, id)
+  return deleted
+}

package/plugins/core/lib/storage/storage-adapter.js

@@ -14,7 +14,7 @@ import {
   translateCanonicalAttributesForStorage,
 } from './canonical-storage-mapping.js'
 import { assertScalarQueryField } from '../querying-writing/field-utils.js'
-import { normalizeValueForDatabaseStorage } from '../querying-writing/database-value-normalizers.js'
+import { assertSingleColumnValue, normalizeValueForDatabaseStorage } from '../querying-writing/database-value-normalizers.js'
 
 /** @import { BaseStorageAdapterOptions, CanonicalDescriptor, SelectTranslator, StorageAdapter, StorageAdapterOptions, StorageAdapterLookupOptions, StorageSchemaInfo, StorageFieldDefinition } from './storage-types.js' */
 
@@ -59,16 +59,22 @@ const normalizeBooleanValue = (value) => {
 }
 
 /**
+ * A filter or cursor value, or a list of them, for one column. Objects and
+ * nested lists are refused: a MySQL driver could expand them into SQL.
  * @param {unknown} value
  * @param {StorageFieldDefinition} [definition]
- * @param {{ isRelationship?: boolean, databaseClient?: string, textStorage?: boolean }} [options]
+ * @param {{ isRelationship?: boolean, databaseClient?: string, textStorage?: boolean, fieldName?: string, parameter?: string }} [options]
  * @returns {unknown}
  */
-const normalizeFilterValueForDefinition = (value, definition = {}, { isRelationship = false, databaseClient, textStorage } = {}) => {
+const normalizeFilterValueForDefinition = (value, definition = {}, { isRelationship = false, databaseClient, textStorage, fieldName, parameter = `filters.${fieldName}` } = {}) => {
   if (value === null || value === undefined) return value
   if (Array.isArray(value)) {
-    return value.map(entry => normalizeFilterValueForDefinition(entry, definition, { isRelationship, databaseClient, textStorage }))
+    return value.map(entry => {
+      assertSingleColumnValue(entry, { fieldName, parameter })
+      return normalizeFilterValueForDefinition(entry, definition, { isRelationship, databaseClient, textStorage, fieldName, parameter })
+    })
   }
+  assertSingleColumnValue(value, { fieldName, parameter })
 
   if (isRelationship) {
     return normalizeBelongsToValue(value)
@@ -181,7 +187,9 @@ const createTableAdapter = ({ knex, schemaInfo }) => {
     const definition = schemaInfo.schemaStructure?.[field]
     return normalizeFilterValueForDefinition(value, definition, {
       isRelationship: Boolean(definition?.belongsTo || definition?.belongsToPolymorphic),
-      databaseClient: knex.client.config.client
+      databaseClient: knex.client.config.client,
+      fieldName: field,
+      parameter: 'page'
     })
   }
   /** @type {StorageAdapter['translateFilterValue']} */
@@ -209,7 +217,7 @@ const createTableAdapter = ({ knex, schemaInfo }) => {
       schemaField?.belongsTo ||
       schemaField?.belongsToPolymorphic
     )
-    return normalizeFilterValueForDefinition(value, definition, { isRelationship, databaseClient: knex.client.config.client })
+    return normalizeFilterValueForDefinition(value, definition, { isRelationship, databaseClient: knex.client.config.client, fieldName: field })
   }
 
   return baseAdapter({
@@ -305,7 +313,7 @@ const createCanonicalAdapter = ({ knex, schemaInfo, descriptor }) => {
     )
     const definition = searchField || schemaField || {}
 
-    return normalizeFilterValueForDefinition(value, definition, { isRelationship, databaseClient: knex.client.config.client, textStorage: fieldsInfo[fieldName]?.slotType === 'string' })
+    return normalizeFilterValueForDefinition(value, definition, { isRelationship, databaseClient: knex.client.config.client, textStorage: fieldsInfo[fieldName]?.slotType === 'string', fieldName: field })
   }
 
   /** @type {StorageAdapter['translateCursorValue']} */
@@ -315,7 +323,9 @@ const createCanonicalAdapter = ({ knex, schemaInfo, descriptor }) => {
     return normalizeFilterValueForDefinition(value, definition, {
       isRelationship: Boolean(definition?.belongsTo || definition?.belongsToPolymorphic),
       databaseClient: knex.client.config.client,
-      textStorage: fieldsInfo[field]?.slotType === 'string'
+      textStorage: fieldsInfo[field]?.slotType === 'string',
+      fieldName: field,
+      parameter: 'page'
     })
   }
 

package/plugins/core/lib/storage/storage-mapping.js

@@ -1,5 +1,6 @@
 // @ts-check
-import { normalizeValueForDatabaseStorage } from '../querying-writing/database-value-normalizers.js'
+import { assertSingleColumnValue, normalizeValueForDatabaseStorage } from '../querying-writing/database-value-normalizers.js'
+import { SERIALIZATION_CAPABILITIES } from '../querying-writing/database-capabilities.js'
 import { assertFieldNameMap } from '../querying-writing/field-utils.js'
 
 /** @import { FieldStorage, StorageConfig, StorageFieldDefinition, StorageInfo, StorageNaming, StorageRow, StorageSchemaInfo, StorageSerializerDetails, StorageWriteOptions } from './storage-types.js' */
@@ -262,6 +263,8 @@ export const serializeFieldValueForStorage = (value, {
     }
     return serialized
   }
+  // Only object and array fields store a structure (as JSON); any other column takes one value.
+  if (!(definition.type && SERIALIZATION_CAPABILITIES.structuredTypes.includes(definition.type))) assertSingleColumnValue(value, { fieldName })
   return normalizeValueForDatabaseStorage(value, definition.type, {
     databaseClient,
     textStorage,

package/plugins/core/lib/storage/storage-types.d.ts

@@ -306,6 +306,13 @@ export interface DataReadHelpers<GetResult> {
   dataGetMinimal: DataMinimalReader
   dataGet: (request: DataReadRequest & {
     context: DataReadContext & { id: string | number }
+    // Apply the row filters in this read, when no minimal read preceded it.
+    scoped?: boolean
+  }) => Promise<GetResult>
+  // dataGet({ scoped: true }), for storages that support it.
+  dataGetScoped?: (request: DataReadRequest & {
+    runHooks: NonNullable<DataReadRequest['runHooks']>
+    context: DataReadContext & { id: string | number }
   }) => Promise<GetResult>
   dataQuery: (request: DataReadRequest & {
     runHooks: NonNullable<DataReadRequest['runHooks']>
@@ -517,7 +524,7 @@ export interface CanonicalDataDependencies {
   getScopeStorageAdapter(scopeName: string): StorageAdapter | null
   getDescriptor(scopeName: string): CanonicalDescriptor
   linkStore: {
-    invalidateDeletedLinkTargets(scopeName: string, context: DataIdentityContext): Promise<void>
+    invalidateDeletedLinkTargets(scopeName: string, context: DataIdentityContext, lockRow: () => Promise<void>): Promise<void>
     deleteResourceLinks(request: { descriptor: CanonicalDescriptor, scopeName: string, id: string | number, db: StorageDatabase }): Promise<void>
   }
   buildIncludes(request: { parentResources: DataResource[], descriptor: CanonicalDescriptor, context: DataReadContext }): Promise<DataResource[]>

package/plugins/core/lib/writing/many-to-many-manipulations.js

@@ -6,7 +6,10 @@ import { whereInIdentifiers } from '../querying/identifier-query.js'
 import { applyDatabaseReadOptions, databaseIdentityExpression } from '../querying-writing/database-value-normalizers.js'
 import { assertVersionedRelationshipTransaction, hasVersionedInverse, invalidateManyToManyVersions } from './resource-version.js'
 
-export async function invalidateDeletedPivotTargets (api, scopeName, context) {
+// Advances the versions of parents linked to a record about to be deleted.
+// When there are such parents, `lockRow` first locks the record's row against
+// link writers, and answers not found when it has gone.
+export async function invalidateDeletedPivotTargets (api, scopeName, context, lockRow) {
   const relationships = []
   for (const [parentType, parent] of Object.entries(api.resources)) {
     if (!parent.vars.schemaInfo?.versionField) continue
@@ -17,7 +20,7 @@ export async function invalidateDeletedPivotTargets (api, scopeName, context) {
   }
   if (!relationships.length) return
   assertVersionedRelationshipTransaction(api, relationships[0], context.transaction)
-  await lockRelationshipTargets(api, context.transaction, [{ type: scopeName, id: context.id }], { exclusive: true })
+  await lockRow()
   const id = api.knex.helpers.getStorageAdapter(scopeName).translateFilterValue('id', context.id)
   for (const inverse of relationships) {
     const pivot = getPivotStorage(api, inverse)

package/plugins/core/lib/writing/relationship-processor.js

@@ -1,6 +1,6 @@
 import { RestApiResourceError, RestApiValidationError } from '../../../../lib/rest-api-errors.js'
 import { validateRelationshipDataCardinality } from '../querying-writing/relationship-contracts.js'
-import { RELATIONSHIP_WRITE_BATCH_SIZE } from '../querying-writing/knex-constants.js'
+import { whereInIdentifiers } from '../querying/identifier-query.js'
 import { applyDatabaseReadOptions, databaseIdentityExpression } from '../querying-writing/database-value-normalizers.js'
 
 export const lockRelationshipParent = async ({ context, helpers, scopeName }) => {
@@ -40,47 +40,43 @@ export const lockRelationshipTargets = async (api, transaction, identifiers, { e
   const resolved = []
   const resources = new Map()
   for (const { type, id } of identifiers) {
-    if (!resources.has(type)) resources.set(type, { adapter: api.knex.helpers.getStorageAdapter(type), seen: new Set(), resolved: new Set() })
-    const { adapter, seen } = resources.get(type)
+    if (!resources.has(type)) resources.set(type, { adapter: api.knex.helpers.getStorageAdapter(type), seen: new Set(), resolved: new Set(), group: [], found: new Set() })
+    const { adapter, seen, group } = resources.get(type)
     const value = adapter.translateFilterValue('id', id)
     if (seen.has(String(value))) continue
     seen.add(String(value))
-    targets.push({ type, id, value, adapter })
+    const target = { type, id, value, adapter }
+    targets.push(target)
+    group.push(target)
   }
-  for (let offset = 0; offset < targets.length; offset += RELATIONSHIP_WRITE_BATCH_SIZE) {
-    const batch = targets.slice(offset, offset + RELATIONSHIP_WRITE_BATCH_SIZE)
-    const byType = new Map()
-    for (const target of batch) {
-      if (!byType.has(target.type)) byType.set(target.type, [])
-      byType.get(target.type).push(target)
-    }
-    const found = new Map()
-    for (const [type, group] of byType) {
-      const { adapter } = group[0]
-      const idColumn = adapter.getIdColumn()
-      const rows = await applyDatabaseReadOptions(lockTargetRows(adapter.buildBaseQuery({ transaction })
-        .whereIn(idColumn, group.map(target => target.value))
-        .orderBy(`${adapter.getTableName()}.${idColumn}`), isExclusive(type)).select({ [idColumn]: databaseIdentityExpression(transaction, idColumn) }))
-      found.set(type, new Set(rows.map(row => String(row[idColumn]))))
-    }
-    for (const { type, id, value, adapter } of batch) {
-      let storedId = String(value)
-      // Let the database resolve alternate spellings under its column collation.
-      if (!found.get(type).has(storedId)) {
-        const record = await applyDatabaseReadOptions(lockTargetRows(adapter.buildBaseQuery({ transaction })
-          .where(adapter.getIdColumn(), value), isExclusive(type)).first({ [adapter.getIdColumn()]: databaseIdentityExpression(transaction, adapter.getIdColumn()) }))
-        if (!record) {
-          throw new RestApiResourceError(`Related ${type} with id ${id} not found`, {
-            subtype: 'not_found', resourceType: type, resourceId: id
-          })
-        }
-        storedId = String(record[adapter.getIdColumn()])
-      }
-      const identities = resources.get(type).resolved
-      if (!identities.has(storedId)) {
-        identities.add(storedId)
-        resolved.push({ type, id })
+  // One statement per target type at any count; whereInIdentifiers binds a long
+  // id list as one parameter where the database limits parameters. Types lock
+  // in name order and each statement in id order, so two writers naming the same
+  // targets in different orders take their locks in the same order.
+  for (const [type, { adapter, group, found }] of [...resources].sort(([left], [right]) => left < right ? -1 : left > right ? 1 : 0)) {
+    const idColumn = adapter.getIdColumn()
+    const rows = await applyDatabaseReadOptions(lockTargetRows(adapter.buildBaseQuery({ transaction })
+      .modify(whereInIdentifiers, idColumn, group.map(target => target.value))
+      .orderBy(`${adapter.getTableName()}.${idColumn}`), isExclusive(type)).select({ [idColumn]: databaseIdentityExpression(transaction, idColumn) }))
+    for (const row of rows) found.add(String(row[idColumn]))
+  }
+  for (const { type, id, value, adapter } of targets) {
+    let storedId = String(value)
+    // Let the database resolve alternate spellings under its column collation.
+    if (!resources.get(type).found.has(storedId)) {
+      const record = await applyDatabaseReadOptions(lockTargetRows(adapter.buildBaseQuery({ transaction })
+        .where(adapter.getIdColumn(), value), isExclusive(type)).first({ [adapter.getIdColumn()]: databaseIdentityExpression(transaction, adapter.getIdColumn()) }))
+      if (!record) {
+        throw new RestApiResourceError(`Related ${type} with id ${id} not found`, {
+          subtype: 'not_found', resourceType: type, resourceId: id
+        })
       }
+      storedId = String(record[adapter.getIdColumn()])
+    }
+    const identities = resources.get(type).resolved
+    if (!identities.has(storedId)) {
+      identities.add(storedId)
+      resolved.push({ type, id })
     }
   }
   // Return each database identity once, retaining its first submitted spelling.

package/plugins/core/rest-api-autofilter-plugin.js

@@ -2,6 +2,7 @@ import { RestApiResourceError, RestApiValidationError } from '../../lib/rest-api
 import { assertGenuineSystemFlag, isSystemContext } from '../../lib/system-context.js'
 import { snapshotResourceConfiguration } from './lib/querying-writing/schema-helpers.js'
 import { createStorageAdapterUtilities } from './lib/querying/storage-adapter-utils.js'
+import { ANY_OWNER, recordWriteCondition } from './lib/querying/query-constraint.js'
 
 const PUBLIC_PRESET_NAME = 'public'
 // Queries that write or lock the rows they select: shared rows are never theirs.
@@ -286,6 +287,13 @@ function refuseSharedCreate ({ filter, resolvedValue, scopeName }) {
   })
 }
 
+// An optional owner that did not resolve stamps nothing; the row must still not end up shared.
+function refuseSharedResult ({ compiledConfig, record, scopeName }) {
+  for (const filter of compiledConfig.filters) {
+    if (filter.shared && sharedFieldValue(record, filter) == null) refuseSharedCreate({ filter, resolvedValue: null, scopeName })
+  }
+}
+
 function sharedFieldValue (record, filter) {
   if (filter.relationshipName) {
     const linkage = record?.relationships?.[filter.relationshipName]?.data
@@ -324,6 +332,7 @@ async function enforceScopedInput ({ compiledConfig, context, scopeName, injectM
       injectMissing
     })
   }
+  if (injectMissing) refuseSharedResult({ compiledConfig, record: context.inputRecord?.data, scopeName })
 }
 
 export const AutoFilterPlugin = {
@@ -386,9 +395,18 @@ export const AutoFilterPlugin = {
           log
         })
 
-        if (resolvedValue === undefined) continue
-
         const columnRef = adapterUtils.translateColumn(scopeName, filter.field, tableName)
+        // Every scoped read records the owner a later write of its rows must
+        // still match, so a single write that reads first carries it too.
+        if (resolvedValue === undefined) {
+          // An optional owner that did not resolve: reads are not narrowed, but
+          // shared rows stay out of writes and locks.
+          if (filter.shared) {
+            if (writes) query.whereNotNull(columnRef)
+            recordWriteCondition(context, scopeName, filter.field, ANY_OWNER)
+          }
+          continue
+        }
         const translatedValue = adapterUtils.translateFilterValue(scopeName, filter.field, resolvedValue)
 
         if (filter.shared) {
@@ -396,15 +414,15 @@ export const AutoFilterPlugin = {
           if (translatedValue === null) {
             if (writes) query.whereRaw('1 = 0')
             else query.whereNull(columnRef)
-          } else if (writes) {
-            query.where(columnRef, translatedValue)
           } else {
-            query.where(builder => builder.where(columnRef, translatedValue).orWhereNull(columnRef))
+            if (writes) query.where(columnRef, translatedValue)
+            else query.where(builder => builder.where(columnRef, translatedValue).orWhereNull(columnRef))
+            recordWriteCondition(context, scopeName, filter.field, translatedValue)
           }
-        } else if (translatedValue === null) {
-          query.whereNull(columnRef)
         } else {
-          query.where(columnRef, translatedValue)
+          if (translatedValue === null) query.whereNull(columnRef)
+          else query.where(columnRef, translatedValue)
+          recordWriteCondition(context, scopeName, filter.field, translatedValue)
         }
       }
     })
@@ -468,6 +486,7 @@ export const AutoFilterPlugin = {
           applyResolvedInputValue({ context: { inputRecord }, filter, resolvedValue, injectMissing: true })
         }
       }
+      for (const inputRecord of context.inputRecords) refuseSharedResult({ compiledConfig, record: inputRecord?.data, scopeName })
     })
 
     // Shared rows are readable by every owner but writable only in a system context.
@@ -486,6 +505,9 @@ export const AutoFilterPlugin = {
     addHook('beforeDataCallPatch', 'autofilter-shared-row-patch', { batch: true }, refuseSharedRowWrite)
     addHook('beforeDataCallPut', 'autofilter-shared-row-put', { batch: true }, refuseSharedRowWrite)
     addHook('beforeDataCallDelete', 'autofilter-shared-row-delete', { batch: true }, refuseSharedRowWrite)
+    // Links of a shared row belong to every owner that sees it.
+    addHook('beforeDataCallPostRelationship', 'autofilter-shared-row-post-relationship', {}, refuseSharedRowWrite)
+    addHook('beforeDataCallDeleteRelationship', 'autofilter-shared-row-delete-relationship', {}, refuseSharedRowWrite)
 
     api.autofilter = {
       getConfig: () => ({

package/plugins/core/rest-api-plugin-methods/aggregate.js

@@ -1,6 +1,7 @@
 import { getRequestContracts, validateRequestContractOrThrow } from '../lib/querying-writing/request-contracts.js'
 import { getEffectiveSortableFields } from '../lib/querying/query-field-sort-helpers.js'
 import { compileAggregateRequest } from '../lib/querying/aggregate-query.js'
+import { isSystemContext } from '../../../lib/system-context.js'
 
 /**
  * Group a filtered collection and compute measures for each group.
@@ -18,7 +19,8 @@ export default async function aggregateMethod ({ params, context, vars, helpers,
     schemaInfo: context.schemaInfo,
     scopeName,
     defaultLimit: vars.queryDefaultLimit,
-    maxLimit: vars.queryMaxLimit
+    maxLimit: vars.queryMaxLimit,
+    system: isSystemContext(context)
   })
   const requestContracts = getRequestContracts({
     scopeName,