nexabase-console 2.1.2 → 2.1.3

package/dist/firestore/Query.js

@@ -1,12 +1,73 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.getCountFromServer = exports.getAggregateFromServer = exports.average = exports.sum = exports.count = exports.getDocs = exports.getCachedDocs = exports.query = void 0;
+exports.getCanonicalQueryKey = getCanonicalQueryKey;
+exports.validateAndDeduplicateServerDocs = validateAndDeduplicateServerDocs;
+const FieldPath_1 = require("./FieldPath");
 const SnapshotManager_1 = require("./SnapshotManager");
 const DocumentReference_1 = require("./DocumentReference");
 const NexaError_1 = require("../errors/NexaError");
-const helpers_1 = require("../utils/helpers");
 const QueryUtils_1 = require("./QueryUtils");
+function getCanonicalQueryKey(collectionPath, constraints) {
+    const parts = [`path:${collectionPath}`];
+    const wheres = constraints
+        .filter((c) => c.type === 'where')
+        .map((c) => {
+        const fp = typeof c.fieldPath === 'string' ? c.fieldPath : c.fieldPath.getPathString();
+        return `${fp}:${c.opStr}:${JSON.stringify(c.value)}`;
+    })
+        .sort();
+    if (wheres.length > 0)
+        parts.push(`where:[${wheres.join(',')}]`);
+    const orderBys = constraints
+        .filter((c) => c.type === 'orderBy')
+        .map((c) => {
+        const fp = typeof c.fieldPath === 'string' ? c.fieldPath : c.fieldPath.getPathString();
+        return `${fp}:${c.directionStr || 'asc'}`;
+    });
+    if (orderBys.length > 0)
+        parts.push(`order:[${orderBys.join(',')}]`);
+    const limitConstraint = constraints.find((c) => c.type === 'limit');
+    if (limitConstraint)
+        parts.push(`limit:${limitConstraint.limitValue}`);
+    const cursorConstraints = constraints.filter((c) => ['startAt', 'startAfter', 'endAt', 'endBefore'].includes(c.type));
+    if (cursorConstraints.length > 0) {
+        const cursors = cursorConstraints.map((c) => {
+            if (c.docSnapshot)
+                return `${c.type}:doc:${c.docSnapshot.id}`;
+            return `${c.type}:val:${JSON.stringify(c.cursorValues)}`;
+        });
+        parts.push(`cursor:[${cursors.join(',')}]`);
+    }
+    return parts.join('|');
+}
+function validateAndDeduplicateServerDocs(docs) {
+    if (!Array.isArray(docs)) {
+        throw new NexaError_1.NexaError('internal', 'Invalid server response: documents must be an array.');
+    }
+    const seenIds = new Set();
+    const validDocs = [];
+    for (const d of docs) {
+        if (!d || typeof d !== 'object')
+            continue;
+        if (typeof d.id !== 'string' || d.id.trim().length === 0 || d.id.includes('/'))
+            continue;
+        if (!d.fields || typeof d.fields !== 'object' || Array.isArray(d.fields))
+            continue;
+        if (!seenIds.has(d.id)) {
+            seenIds.add(d.id);
+            validDocs.push({
+                id: d.id,
+                fields: d.fields
+            });
+        }
+    }
+    return validDocs;
+}
 const query = (queryObject, ...queryConstraints) => {
+    if (!queryObject || typeof queryObject !== 'object' || !queryObject.path) {
+        throw new NexaError_1.NexaError('invalid-argument', 'First argument to query() must be a valid Query or CollectionReference.');
+    }
     const q = {
         type: 'query',
         path: queryObject.path,
@@ -14,13 +75,57 @@ const query = (queryObject, ...queryConstraints) => {
         constraints: queryObject.type === 'query' ? [...(queryObject.constraints || [])] : []
     };
     q.constraints = [...(q.constraints || []), ...queryConstraints];
-    // Basic client-side validation
+    // Validate constraint combinations
+    let inequalityField = null;
+    let hasNotEquals = false;
+    let hasNotIn = false;
+    let inOrNotInOrArrayContainsAnyCount = 0;
+    let arrayContainsCount = 0;
     for (const c of q.constraints) {
-        if (c.type === 'limit' && (!Number.isSafeInteger(c.limitValue) || c.limitValue <= 0)) {
-            throw Object.assign(new Error('Limit must be a positive safe integer.'), { code: 'invalid-argument' });
+        if (c.type === 'where') {
+            const fieldStr = typeof c.fieldPath === 'string' ? c.fieldPath : c.fieldPath.getPathString();
+            if (['<', '<=', '>', '>=', '!=', 'not-in'].includes(c.opStr || '')) {
+                if (inequalityField && inequalityField !== fieldStr) {
+                    throw new NexaError_1.NexaError('invalid-argument', 'All where filters with an inequality (<, <=, >, >=, !=, not-in) must be on the same field.');
+                }
+                inequalityField = fieldStr;
+            }
+            if (c.opStr === '!=') {
+                if (hasNotIn) {
+                    throw new NexaError_1.NexaError('invalid-argument', 'Cannot combine != with not-in in a single query.');
+                }
+                hasNotEquals = true;
+            }
+            if (c.opStr === 'not-in') {
+                if (hasNotEquals) {
+                    throw new NexaError_1.NexaError('invalid-argument', 'Cannot combine != with not-in in a single query.');
+                }
+                hasNotIn = true;
+            }
+            if (['in', 'not-in', 'array-contains-any'].includes(c.opStr || '')) {
+                inOrNotInOrArrayContainsAnyCount++;
+                if (inOrNotInOrArrayContainsAnyCount > 1) {
+                    throw new NexaError_1.NexaError('invalid-argument', 'A query cannot have more than one in, not-in, or array-contains-any filter.');
+                }
+            }
+            if (c.opStr === 'array-contains') {
+                arrayContainsCount++;
+                if (arrayContainsCount > 1) {
+                    throw new NexaError_1.NexaError('invalid-argument', 'A query cannot have more than one array-contains filter.');
+                }
+            }
         }
-        if (['in', 'not-in', 'array-contains-any'].includes(c.opStr || '') && (!Array.isArray(c.value) || c.value.length === 0)) {
-            throw Object.assign(new Error(`Invalid value for ${c.opStr}: must be a non-empty array.`), { code: 'invalid-argument' });
+    }
+    // If inequality filter exists, verify first explicit orderBy matches the inequality field
+    if (inequalityField) {
+        const firstOrderBy = q.constraints.find((c) => c.type === 'orderBy');
+        if (firstOrderBy) {
+            const orderFieldStr = typeof firstOrderBy.fieldPath === 'string'
+                ? firstOrderBy.fieldPath
+                : firstOrderBy.fieldPath.getPathString();
+            if (orderFieldStr !== inequalityField && orderFieldStr !== '__name__') {
+                throw new NexaError_1.NexaError('invalid-argument', `The first orderBy field (${orderFieldStr}) must match the inequality filter field (${inequalityField}).`);
+            }
         }
     }
     return q;
@@ -38,31 +143,49 @@ const getCachedDocs = (queryOrCollection, fromCache = true) => {
             const docId = parts[parts.length - 1];
             const docRef = (0, DocumentReference_1.doc)(db, `${collectionPath}/${docId}`);
             const cachedData = (0, QueryUtils_1.cloneNexaData)(db._firestoreCache[p]);
-            results.push({
-                id: docId,
-                ref: docRef,
-                metadata: { fromCache, hasPendingWrites: db.hasPendingWrites(docRef.path) },
-                exists: () => true,
-                data: () => cachedData,
-                get: (fieldPath) => (0, helpers_1.getNestedValue)(cachedData, fieldPath, docId)
-            });
+            if (cachedData !== null && cachedData !== undefined) {
+                results.push({
+                    id: docId,
+                    ref: docRef,
+                    metadata: { fromCache, hasPendingWrites: db.hasPendingWrites(docRef.path) },
+                    exists: () => true,
+                    data: () => (0, QueryUtils_1.cloneNexaData)(cachedData),
+                    get: (fieldPath) => {
+                        if (fieldPath === '__name__' || (fieldPath instanceof FieldPath_1.FieldPath && fieldPath.segments[0] === '__name__')) {
+                            return docId;
+                        }
+                        return (0, QueryUtils_1.getNestedValue)(cachedData, fieldPath);
+                    }
+                });
+            }
         }
     }
     let filtered = results;
     let limitCount = undefined;
     const orderBys = [];
     for (const c of constraints) {
-        if (c.type === 'orderBy')
+        if (c.type === 'orderBy') {
             orderBys.push(c);
+        }
     }
-    // Add implicit tie-breaker by document ID
-    orderBys.push({ type: 'orderBy', fieldPath: '__name__', directionStr: 'asc' });
+    // Add implicit tie-breaker by document ID if __name__ is not explicitly ordered
+    const hasNameOrder = orderBys.some((ob) => {
+        const fp = typeof ob.fieldPath === 'string' ? ob.fieldPath : ob.fieldPath?.getPathString();
+        return fp === '__name__';
+    });
+    if (!hasNameOrder) {
+        const lastDirection = orderBys.length > 0 ? orderBys[orderBys.length - 1].directionStr || 'asc' : 'asc';
+        orderBys.push({ type: 'orderBy', fieldPath: '__name__', directionStr: lastDirection });
+    }
+    // Where filtering
     for (const c of constraints) {
         if (c.type === 'where' && c.fieldPath && c.opStr) {
             filtered = filtered.filter((docItem) => {
-                const val = (0, helpers_1.getNestedValue)(docItem.data(), c.fieldPath, docItem.id);
+                const val = c.fieldPath === '__name__' || (c.fieldPath instanceof FieldPath_1.FieldPath && c.fieldPath.segments[0] === '__name__')
+                    ? docItem.id
+                    : (0, QueryUtils_1.getNestedValue)(docItem.data(), c.fieldPath);
                 if (val === undefined) {
-                    // Missing fields should not match inequalities by default
+                    // Missing fields do not match inequalities
                     if (['!=', 'not-in', '<', '<=', '>', '>='].includes(c.opStr))
                         return false;
                 }
@@ -86,26 +209,28 @@ const getCachedDocs = (queryOrCollection, fromCache = true) => {
                     return Array.isArray(val) && val.some((v) => (0, QueryUtils_1.compareNexaValues)(v, c.value) === 0);
                 if (c.opStr === 'array-contains-any')
                     return Array.isArray(val) && Array.isArray(c.value) && c.value.some((cVal) => val.some((v) => (0, QueryUtils_1.compareNexaValues)(v, cVal) === 0));
-                throw new Error(`Unsupported operator: ${c.opStr}`);
+                throw new NexaError_1.NexaError('invalid-argument', `Unsupported query operator: ${c.opStr}`);
             });
         }
     }
     // Documents without orderBy field must be excluded
     filtered = filtered.filter((docItem) => {
         for (const ob of orderBys) {
-            if (ob.fieldPath !== '__name__') {
-                const val = (0, helpers_1.getNestedValue)(docItem.data(), ob.fieldPath, docItem.id);
+            const fieldStr = typeof ob.fieldPath === 'string' ? ob.fieldPath : ob.fieldPath?.getPathString();
+            if (fieldStr !== '__name__') {
+                const val = (0, QueryUtils_1.getNestedValue)(docItem.data(), ob.fieldPath);
                 if (val === undefined)
                     return false;
             }
         }
         return true;
     });
+    // Sorting
     filtered = [...filtered].sort((a, b) => {
         for (const ob of orderBys) {
-            const field = ob.fieldPath === '__name__' ? null : ob.fieldPath;
-            const valA = field ? (0, helpers_1.getNestedValue)(a.data(), field, a.id) : a.id;
-            const valB = field ? (0, helpers_1.getNestedValue)(b.data(), field, b.id) : b.id;
+            const fieldStr = typeof ob.fieldPath === 'string' ? ob.fieldPath : ob.fieldPath?.getPathString();
+            const valA = fieldStr === '__name__' ? a.id : (0, QueryUtils_1.getNestedValue)(a.data(), ob.fieldPath);
+            const valB = fieldStr === '__name__' ? b.id : (0, QueryUtils_1.getNestedValue)(b.data(), ob.fieldPath);
             const comp = (0, QueryUtils_1.compareNexaValues)(valA, valB);
             if (comp !== 0) {
                 return ob.directionStr === 'desc' ? -comp : comp;
@@ -113,26 +238,29 @@ const getCachedDocs = (queryOrCollection, fromCache = true) => {
         }
         return 0;
     });
+    // Cursors and limits
     for (const c of constraints) {
         if (['startAt', 'startAfter', 'endAt', 'endBefore'].includes(c.type)) {
             const isSnapshot = c.docSnapshot && typeof c.docSnapshot === 'object' && 'id' in c.docSnapshot;
             const cursorVals = isSnapshot
-                ? orderBys.map(ob => {
-                    if (ob.fieldPath === '__name__')
+                ? orderBys.map((ob) => {
+                    const fieldStr = typeof ob.fieldPath === 'string' ? ob.fieldPath : ob.fieldPath?.getPathString();
+                    if (fieldStr === '__name__')
                         return c.docSnapshot.id;
                     return typeof c.docSnapshot.get === 'function'
                         ? c.docSnapshot.get(ob.fieldPath)
-                        : (0, helpers_1.getNestedValue)(c.docSnapshot.data ? c.docSnapshot.data() : c.docSnapshot, ob.fieldPath, c.docSnapshot.id);
+                        : (0, QueryUtils_1.getNestedValue)(c.docSnapshot.data ? c.docSnapshot.data() : c.docSnapshot, ob.fieldPath);
                 })
                 : (Array.isArray(c.cursorValues) ? c.cursorValues : [c.cursorValues]);
-            filtered = filtered.filter(d => {
+            filtered = filtered.filter((d) => {
                 for (let i = 0; i < Math.min(orderBys.length, cursorVals.length); i++) {
-                    const field = orderBys[i].fieldPath === '__name__' ? null : orderBys[i].fieldPath;
-                    const dVal = field ? (0, helpers_1.getNestedValue)(d.data(), field, d.id) : d.id;
+                    const ob = orderBys[i];
+                    const fieldStr = typeof ob.fieldPath === 'string' ? ob.fieldPath : ob.fieldPath?.getPathString();
+                    const dVal = fieldStr === '__name__' ? d.id : (0, QueryUtils_1.getNestedValue)(d.data(), ob.fieldPath);
                     const cVal = cursorVals[i];
                     const comp = (0, QueryUtils_1.compareNexaValues)(dVal, cVal);
                     if (comp !== 0) {
-                        const dir = orderBys[i].directionStr === 'desc' ? -1 : 1;
+                        const dir = ob.directionStr === 'desc' ? -1 : 1;
                         const adjustedComp = comp * dir;
                         if (c.type === 'startAt' || c.type === 'startAfter')
                             return adjustedComp > 0;
@@ -153,7 +281,7 @@ const getCachedDocs = (queryOrCollection, fromCache = true) => {
     if (limitCount !== undefined) {
         filtered = filtered.slice(0, limitCount);
     }
-    return SnapshotManager_1.SnapshotManager.createQuerySnapshot(filtered, fromCache, filtered.some(d => d.metadata.hasPendingWrites) || db.hasPendingWrites(collectionPath));
+    return SnapshotManager_1.SnapshotManager.createQuerySnapshot(filtered, fromCache, filtered.some((d) => d.metadata.hasPendingWrites) || db.hasPendingWrites(collectionPath));
 };
 exports.getCachedDocs = getCachedDocs;
 const getDocs = async (queryOrCollection) => {
@@ -163,57 +291,63 @@ const getDocs = async (queryOrCollection) => {
     const collectionPath = queryOrCollection.path;
     const constraints = 'constraints' in queryOrCollection ? queryOrCollection.constraints || [] : [];
     const serializedConstraints = constraints.map(QueryUtils_1.serializeConstraint);
+    const queryKey = getCanonicalQueryKey(collectionPath, constraints);
+    // Track request timestamp to prevent stale responses from overwriting newer cache
+    const requestTimestamp = Date.now();
+    db._activeQueryTimestamps.set(queryKey, requestTimestamp);
     if (db.cacheStrategy === 'cache-first') {
         const cached = (0, exports.getCachedDocs)(queryOrCollection, true);
-        if (cached && (db._queryCacheMetadata[collectionPath] || !cached.empty)) {
+        if (cached && (db._queryCacheMetadata[queryKey] || !cached.empty)) {
             // background refresh
             db.client
                 .post(`/api/firestore/${db.projectId}/query`, { collectionPath, constraints: serializedConstraints })
                 .then(async (res) => {
-                const docs = res.data?.documents;
-                if (!Array.isArray(docs))
+                // Check if a newer request has already superseded this one
+                if (db._activeQueryTimestamps.get(queryKey) !== requestTimestamp) {
                     return;
+                }
+                const rawDocs = res.data?.documents;
+                if (!Array.isArray(rawDocs))
+                    return;
+                const validDocs = validateAndDeduplicateServerDocs(rawDocs);
                 const complete = res.data?.complete === true;
                 await db._commitAtomicQueryResults({
-                    queryKey: collectionPath,
+                    queryKey,
                     collectionPath,
-                    serverDocs: docs,
+                    serverDocs: validDocs,
                     isComplete: complete,
                     constraints: serializedConstraints
                 });
-                db._queryCacheMetadata[collectionPath] = true;
+                db._queryCacheMetadata[queryKey] = true;
                 db._notifySnapshotCallbacks(collectionPath, 'bulk_update', null);
             })
                 .catch((err) => {
-                console.error('[NexaBase] Background query refresh failed:', err);
+                console.error('[NexaBase] Background query refresh error:', err);
             });
             return cached;
         }
     }
     try {
-        const res = await db.client.post(`/api/firestore/${db.projectId}/query`, { collectionPath, constraints: serializedConstraints });
-        const docs = res.data?.documents;
-        if (!Array.isArray(docs)) {
-            throw Object.assign(new Error('Invalid server response: documents must be an array'), { code: 'internal' });
-        }
-        const seenIds = new Set();
-        const validDocs = [];
-        for (const d of docs) {
-            if (d && typeof d.id === 'string' && d.fields && typeof d.fields === 'object' && !seenIds.has(d.id)) {
-                seenIds.add(d.id);
-                validDocs.push(d);
-            }
+        const res = await db.client.post(`/api/firestore/${db.projectId}/query`, {
+            collectionPath,
+            constraints: serializedConstraints
+        });
+        if (db._activeQueryTimestamps.get(queryKey) !== requestTimestamp) {
+            // Stale response superseded by a newer query
+            return (0, exports.getCachedDocs)(queryOrCollection, false);
         }
+        const rawDocs = res.data?.documents;
+        const validDocs = validateAndDeduplicateServerDocs(rawDocs);
         const complete = res.data?.complete === true;
         // Apply results while preserving pending mutations safely
         await db._commitAtomicQueryResults({
-            queryKey: collectionPath,
+            queryKey,
             collectionPath,
             serverDocs: validDocs,
             isComplete: complete,
             constraints: serializedConstraints
         });
-        db._queryCacheMetadata[collectionPath] = true;
+        db._queryCacheMetadata[queryKey] = true;
         // After persistence, read the newly reconciled local state
         return (0, exports.getCachedDocs)(queryOrCollection, false);
     }
@@ -251,7 +385,7 @@ const getAggregateFromServer = async (queryOrCollection, aggregateSpec) => {
     const constraints = 'constraints' in queryOrCollection ? queryOrCollection.constraints || [] : [];
     const serializedSpec = {};
     for (const [key, spec] of Object.entries(aggregateSpec)) {
-        if (key === '__proto__' || key === 'constructor')
+        if (key === '__proto__' || key === 'constructor' || key === 'prototype')
             continue;
         let fp = spec.fieldPath;
         if (fp && typeof fp === 'object' && 'getPathString' in fp && typeof fp.getPathString === 'function') {
@@ -269,7 +403,7 @@ const getAggregateFromServer = async (queryOrCollection, aggregateSpec) => {
             aggregateSpec: serializedSpec
         });
         if (!res.data || typeof res.data.result !== 'object' || res.data.result === null) {
-            throw Object.assign(new Error('Invalid aggregate server response'), { code: 'internal' });
+            throw new NexaError_1.NexaError('internal', 'Invalid aggregate server response');
         }
         return {
             type: 'AggregateQuerySnapshot',

package/dist/firestore/QueryUtils.d.ts

@@ -1,5 +1,22 @@
+import { FieldPath } from './FieldPath';
 export declare function isDirectChildDocument(collectionPath: string, documentPath: string): boolean;
-export declare function reviveNexaData(data: any): any;
-export declare function cloneNexaData(data: any): any;
+export declare function getNestedValue(obj: any, fieldPath: string | FieldPath): any;
+/**
+ * Type-aware codec that preserves supported Firestore primitives/classes
+ * while rejecting cycles, unsupported prototypes, and prototype pollution.
+ */
+export declare function cloneNexaData(data: any, seen?: WeakSet<object>): any;
+/**
+ * Revives serialized JSON data back into rich Nexa/Firestore types.
+ * Never infers Timestamp from an unbranded ordinary object.
+ */
+export declare function reviveNexaData(data: any, seen?: WeakSet<object>): any;
+/**
+ * Deterministic Firestore-compatible value comparison.
+ */
 export declare function compareNexaValues(a: any, b: any): number;
+/**
+ * Deterministic deep equality check.
+ */
+export declare function deepEqual(a: any, b: any, seen?: WeakSet<object>): boolean;
 export declare function serializeConstraint(c: any): any;