remult 0.25.8-exp.2 → 0.25.8-exp.3

package/esm/graphql.js

@@ -904,7 +904,7 @@ export function translateWhereToRestBody(fields, { where }) {
         }
     }
     if (where.OR) {
-        result.OR = where.OR.map((where) => translateWhereToRestBody(fields, { where }));
+        result.OR = where.OR.map((where) => translateWhereToRestBody(fields, { where }).where);
     }
-    return result;
+    return { where: result };
 }

package/esm/server/expressBridge.js

@@ -250,8 +250,8 @@ export class RemultServerImplementation {
             console.info('[remult] ' + myRoute);
         r.route(myRoute)
             .get(this.process((c, req, res, orig) => dataApiFactory(c).httpGet(res, req, () => this.serializeContext(c))))
-            .put(this.process(async (c, req, res, _, __, orig) => dataApiFactory(c).put(res, '', await this.coreOptions.getRequestBody(orig))))
-            .delete(this.process(async (c, req, res, orig) => dataApiFactory(c).delete(res, '')))
+            .put(this.process(async (c, req, res, _, __, orig) => dataApiFactory(c).updateMany(res, req, await this.coreOptions.getRequestBody(orig))))
+            .delete(this.process(async (c, req, res, _, __, orig) => dataApiFactory(c).deleteMany(res, req, undefined)))
             .post(this.process(async (c, req, res, _, __, orig) => dataApiFactory(c).httpPost(res, req, await this.coreOptions.getRequestBody(orig), () => this.serializeContext(c))));
         r.route(myRoute + '/:id')
             //@ts-ignore
@@ -467,6 +467,17 @@ export class RemultServerImplementation {
                     return secureBase(condition, def, item);
                 };
                 let apiPath = (spec.paths[this.options.rootPath + '/' + key] = {});
+                let itemInBody = {
+                    requestBody: {
+                        content: {
+                            'application/json': {
+                                schema: {
+                                    $ref: '#/components/schemas/' + mutationKey,
+                                },
+                            },
+                        },
+                    },
+                };
                 let apiPathWithId = (spec.paths[this.options.rootPath + '/' + key + '/{id}'] = {});
                 //https://github.com/2fd/open-api.d.ts
                 apiPath.get = secure(meta.options.allowApiRead, true, {
@@ -519,6 +530,73 @@ export class RemultServerImplementation {
                         },
                     },
                 });
+                apiPath.delete = secure(meta.options.allowApiDelete, true, {
+                    description: 'deletes row of ' +
+                        key +
+                        '. supports filter operators. For more info on filtering [see this article](https://remult.dev/docs/rest-api.html#filter)',
+                    parameters: [...parameters],
+                    responses: {
+                        '400': {
+                            description: 'Error: Bad Request',
+                            content: {
+                                'application/json': {
+                                    schema: {
+                                        $ref: '#/components/schemas/InvalidResponse',
+                                    },
+                                },
+                            },
+                        },
+                        '200': {
+                            description: 'returns the number of deleted rows ' + key,
+                            content: {
+                                'application/json': {
+                                    schema: {
+                                        type: 'object',
+                                        properties: {
+                                            deleted: {
+                                                type: 'number',
+                                            },
+                                        },
+                                    },
+                                },
+                            },
+                        },
+                    },
+                });
+                apiPath.put = secure(meta.options.allowApiDelete, true, {
+                    description: 'updates row of ' +
+                        key +
+                        '. supports filter operators. For more info on filtering [see this article](https://remult.dev/docs/rest-api.html#filter)',
+                    parameters: [...parameters],
+                    ...itemInBody,
+                    responses: {
+                        '400': {
+                            description: 'Error: Bad Request',
+                            content: {
+                                'application/json': {
+                                    schema: {
+                                        $ref: '#/components/schemas/InvalidResponse',
+                                    },
+                                },
+                            },
+                        },
+                        '200': {
+                            description: 'returns the number of updated rows ' + key,
+                            content: {
+                                'application/json': {
+                                    schema: {
+                                        type: 'object',
+                                        properties: {
+                                            updated: {
+                                                type: 'number',
+                                            },
+                                        },
+                                    },
+                                },
+                            },
+                        },
+                    },
+                });
                 let idParameter = {
                     name: 'id',
                     in: 'path',
@@ -526,17 +604,6 @@ export class RemultServerImplementation {
                     required: true,
                     schema: { type: 'string' },
                 };
-                let itemInBody = {
-                    requestBody: {
-                        content: {
-                            'application/json': {
-                                schema: {
-                                    $ref: '#/components/schemas/' + mutationKey,
-                                },
-                            },
-                        },
-                    },
-                };
                 apiPath.post = secure(meta.options.allowApiInsert, false, {
                     //"summary": "insert a " + key,
                     //"description": "insert a " + key,

package/esm/src/data-api.js

@@ -33,7 +33,7 @@ export class DataApi {
             case 'deleteMany':
                 return this.deleteMany(res, req, body);
             case 'updateMany':
-                return this.updateMany(res, req, body);
+                return this.updateManyImplementation(res, req, body);
             case 'endLiveQuery':
                 await this.remult.liveQueryStorage.remove(body.id);
                 res.success('ok');
@@ -50,26 +50,28 @@ export class DataApi {
         }
         await this.doOnId(response, id, async (row) => response.success(this.repository.getEntityRef(row).toApiJson()));
     }
-    async count(response, request, filterBody) {
+    async count(response, request, body) {
         if (!this.repository.metadata.apiReadAllowed) {
             response.forbidden();
             return;
         }
         try {
             response.success({
-                count: +(await this.repository.count(await this.buildWhere(request, filterBody))),
+                count: +(await this.repository.count(await this.buildWhere(request, body))),
             });
         }
         catch (err) {
             response.error(err, this.repository.metadata);
         }
     }
-    async deleteMany(response, request, filterBody) {
+    async deleteMany(response, request, body) {
         try {
+            let deleted = 0;
+            let where = await this.buildWhere(request, body);
+            Filter.throwErrorIfFilterIsEmpty(where, 'deleteMany');
             return await doTransaction(this.remult, async () => {
-                let deleted = 0;
                 for await (const x of this.repository.query({
-                    where: await this.buildWhere(request, filterBody),
+                    where,
                     include: this.includeNone(),
                 })) {
                     await this.actualDelete(x);
@@ -82,12 +84,12 @@ export class DataApi {
             response.error(err, this.repository.metadata);
         }
     }
-    async getArrayImpl(response, request, filterBody) {
+    async getArrayImpl(response, request, body) {
         let findOptions = {
             load: () => [],
             include: this.includeNone(),
         };
-        findOptions.where = await this.buildWhere(request, filterBody);
+        findOptions.where = await this.buildWhere(request, body);
         if (request) {
             let sort = request.get('_sort');
             if (sort != undefined) {
@@ -146,13 +148,13 @@ export class DataApi {
         }
         return include;
     }
-    async getArray(response, request, filterBody) {
+    async getArray(response, request, body) {
         if (!this.repository.metadata.apiReadAllowed) {
             response.forbidden();
             return;
         }
         try {
-            const { r } = await this.getArrayImpl(response, request, filterBody);
+            const { r } = await this.getArrayImpl(response, request, body);
             response.success(r);
         }
         catch (err) {
@@ -162,13 +164,13 @@ export class DataApi {
                 response.error(err, this.repository.metadata);
         }
     }
-    async liveQuery(response, request, filterBody, serializeContext, queryChannel) {
+    async liveQuery(response, request, body, serializeContext, queryChannel) {
         if (!this.repository.metadata.apiReadAllowed) {
             response.forbidden();
             return;
         }
         try {
-            const r = await this.getArrayImpl(response, request, filterBody);
+            const r = await this.getArrayImpl(response, request, body);
             const data = {
                 requestJson: await serializeContext(),
                 findOptionsJson: findOptionsToJson(r.findOptions, this.repository.metadata),
@@ -188,7 +190,7 @@ export class DataApi {
                 response.error(err, this.repository.metadata);
         }
     }
-    async buildWhere(request, filterBody) {
+    async buildWhere(request, body) {
         var where = [];
         if (this.repository.metadata.options.apiPrefilter) {
             if (typeof this.repository.metadata.options.apiPrefilter === 'function')
@@ -208,8 +210,8 @@ export class DataApi {
                 },
             }));
         }
-        if (filterBody)
-            where.push(Filter.entityFilterFromJson(this.repository.metadata, filterBody));
+        if (body?.where)
+            where.push(Filter.entityFilterFromJson(this.repository.metadata, body.where));
         return { $and: where };
     }
     async doOnId(response, id, what) {
@@ -245,11 +247,23 @@ export class DataApi {
         }
     }
     async updateMany(response, request, body) {
+        const action = request?.get('__action');
+        if (action == 'emptyId') {
+            return this.put(response, '', body);
+        }
+        let where = await this.buildWhere(request, body);
+        Filter.throwErrorIfFilterIsEmpty(where, 'updateMany');
+        return this.updateManyImplementation(response, request, {
+            where: undefined,
+            set: body,
+        });
+    }
+    async updateManyImplementation(response, request, body) {
         try {
             return await doTransaction(this.remult, async () => {
                 let updated = 0;
                 for await (const x of this.repository.query({
-                    where: await this.buildWhere(request, body.where),
+                    where: await this.buildWhere(request, body),
                     include: this.includeNone(),
                 })) {
                     await this.actualUpdate(x, body.set);

package/esm/src/data-providers/rest-data-provider.js

@@ -120,26 +120,27 @@ export class RestEntityDataProvider {
         return run('count').then((r) => +r.count);
     }
     async deleteMany(where) {
-        const { run } = this.buildFindRequest({ where }, true);
+        const { run } = this.buildFindRequest({ where }, 'delete');
         return run('deleteMany').then((r) => +r.deleted);
     }
     async updateMany(where, data) {
-        const { run } = this.buildFindRequest({ where }, true);
-        return run('updateMany', { set: this.toJsonOfIncludedKeys(data) }).then((r) => +r.updated);
+        const { run } = this.buildFindRequest({ where }, 'put');
+        return run('updateMany', this.toJsonOfIncludedKeys(data)).then((r) => +r.updated);
     }
     find(options) {
         let { run } = this.buildFindRequest(options);
         return run().then((x) => x.map((y) => this.translateFromJson(y)));
     }
     //@internal
-    buildFindRequest(options, forcePost = false) {
+    buildFindRequest(options, method) {
+        if (!method)
+            method = 'get';
         let url = new UrlBuilder(this.url());
         let filterObject;
         if (options) {
             if (options.where) {
                 filterObject = options.where.toJson(); //        options.where.__applyToConsumer(new FilterConsumnerBridgeToUrlBuilder(url));
-                if (!forcePost &&
-                    addFilterToUrlAndReturnTrueIfSuccessful(filterObject, url))
+                if (addFilterToUrlAndReturnTrueIfSuccessful(filterObject, url))
                     filterObject = undefined;
             }
             if (options.orderBy && options.orderBy.Segments) {
@@ -173,15 +174,12 @@ export class RestEntityDataProvider {
             }
             if (action)
                 u.add('__action', action);
-            if (filterObject || forcePost) {
-                if (!body)
-                    body = filterObject;
-                else
-                    body = { ...body, where: filterObject };
+            if (filterObject) {
+                body = { set: body, where: filterObject };
                 return this.http().post(u.url, body);
             }
             else
-                return this.http().get(u.url);
+                return this.http()[method](u.url, body);
         };
         return {
             createKey: () => JSON.stringify({ url, filterObject }),
@@ -201,7 +199,8 @@ export class RestEntityDataProvider {
     }
     update(id, data) {
         return this.http()
-            .put(this.url() + '/' + encodeURIComponent(id), this.toJsonOfIncludedKeys(data))
+            .put(this.url() +
+            (id != '' ? '/' + encodeURIComponent(id) : '?__action=emptyId'), this.toJsonOfIncludedKeys(data))
             .then((y) => this.translateFromJson(y));
     }
     toJsonOfIncludedKeys(data) {
@@ -213,8 +212,11 @@ export class RestEntityDataProvider {
         }
         return result;
     }
-    delete(id) {
-        return this.http().delete(this.url() + '/' + encodeURIComponent(id));
+    async delete(id) {
+        if (id == '')
+            await this.deleteMany(Filter.fromEntityFilter(this.entity, this.entity.idMetadata.getIdFilter(id)));
+        else
+            return this.http().delete(this.url() + '/' + encodeURIComponent(id));
     }
     insert(data) {
         return this.http()

package/esm/src/filter/filter-interfaces.js

@@ -6,6 +6,37 @@ import { getRelationFieldInfo } from '../remult3/relationInfoMember.js';
  */
 export class Filter {
     apply;
+    //@internal
+    static throwErrorIfFilterIsEmpty(where, methodName) {
+        if (Filter.isFilterEmpty(where)) {
+            throw {
+                message: `${methodName}: requires a filter to protect against accidental delete/update of all rows`,
+                httpStatusCode: 400,
+            };
+        }
+    }
+    //@internal
+    static isFilterEmpty(where) {
+        if (where.$and) {
+            for (const a of where.$and) {
+                if (!Filter.isFilterEmpty(a)) {
+                    return false;
+                }
+            }
+        }
+        if (where.$or) {
+            for (const a of where.$or) {
+                if (Filter.isFilterEmpty(a)) {
+                    return true;
+                }
+            }
+            return false;
+        }
+        if (Object.keys(where).filter((x) => !['$or', '$and'].includes(x)).length == 0) {
+            return true;
+        }
+        return false;
+    }
     static createCustom(rawFilterTranslator, key = '') {
         let rawFilterInfo = { key: key, rawFilterTranslator };
         return Object.assign((x) => {

package/esm/src/remult3/RepositoryImplementation.js

@@ -270,6 +270,7 @@ export class RepositoryImplementation {
         }
     }
     async updateMany(where, set) {
+        Filter.throwErrorIfFilterIsEmpty(where, 'updateMany');
         if (this._dataProvider.isProxy) {
             return this._edp.updateMany(await this._translateWhereToFilter(where), set);
         }
@@ -636,6 +637,7 @@ export class RepositoryImplementation {
         return this._edp.count(await this._translateWhereToFilter(where));
     }
     async deleteMany(where) {
+        Filter.throwErrorIfFilterIsEmpty(where, 'deleteMany');
         if (this._dataProvider.isProxy) {
             return this._edp.deleteMany(await this._translateWhereToFilter(where));
         }

package/esm/src/remult3/remult3.js

@@ -1,16 +1,10 @@
 export {};
+//y1 - reconsider adding where to all in case of post - it is a breaking change and no longer required
+//y1 - review that with deleteMany, and updateMany I've taken a similar approach to get, that when the filter is complex, we go to post - one reason is that delete doesn't accept a body.
+//y1 - should the remult api be deleteMany({id:[1,2]}) or deleteMany({where:{id:[1,2]}})
 //p1 - in this video I'll use remult to turn a frontend app to a fullstack app
-/*p1 - discuss using delete & put - with url query language for deleteMany and updateMany -
-- put & delete, similar to get
-- add where to count, deleteMany,updateMany,
-- prevent delete all and update all - must have meaningful where.
-- try forcing this also in typescript
-
-- protect against deleting of all rows by mistake
-- https://github.com/remult/remult/issues/221#issuecomment-2016519746
-
-*/
 //y1 - getFields didn't work for kobi in the home component
+//y1 - consider replacing all errors with error classes that extend the base Error class
 //p1 - document offline support
 //p1 - add section to Fields doc, explaining field type in db
 //p1 - add section about union type

package/esm/src/valueConverters.js

@@ -136,7 +136,7 @@ export class ValueConverters {
         toJson: (value) => ValueConverters.Number.toDb(value),
         fromInput: (x, type) => {
             let r = +x;
-            if (!x)
+            if (x === null || x === undefined)
                 return undefined;
             return r;
         },

package/graphql.js

@@ -1081,10 +1081,8 @@ function translateWhereToRestBody(fields, _a) {
         finally { if (e_7) throw e_7.error; }
     }
     if (where.OR) {
-        result.OR = where.OR.map(function (where) {
-            return translateWhereToRestBody(fields, { where: where });
-        });
+        result.OR = where.OR.map(function (where) { return translateWhereToRestBody(fields, { where: where }).where; });
     }
-    return result;
+    return { where: result };
 }
 exports.translateWhereToRestBody = translateWhereToRestBody;

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "remult",
-    "version": "0.25.8-exp.2",
+    "version": "0.25.8-exp.3",
     "description": "A CRUD framework for full-stack TypeScript",
     "homepage": "https://remult.dev",
     "repository": {

package/server/expressBridge.js

@@ -444,16 +444,16 @@ var RemultServerImplementation = /** @class */ (function () {
             return tslib_1.__generator(this, function (_d) {
                 switch (_d.label) {
                     case 0:
-                        _b = (_a = dataApiFactory(c)).put;
+                        _b = (_a = dataApiFactory(c)).updateMany;
                         _c = [res,
-                            ''];
+                            req];
                         return [4 /*yield*/, this.coreOptions.getRequestBody(orig)];
                     case 1: return [2 /*return*/, _b.apply(_a, _c.concat([_d.sent()]))];
                 }
             });
         }); }))
-            .delete(this.process(function (c, req, res, orig) { return tslib_1.__awaiter(_this, void 0, void 0, function () { return tslib_1.__generator(this, function (_a) {
-            return [2 /*return*/, dataApiFactory(c).delete(res, '')];
+            .delete(this.process(function (c, req, res, _, __, orig) { return tslib_1.__awaiter(_this, void 0, void 0, function () { return tslib_1.__generator(this, function (_a) {
+            return [2 /*return*/, dataApiFactory(c).deleteMany(res, req, undefined)];
         }); }); }))
             .post(this.process(function (c, req, res, _, __, orig) { return tslib_1.__awaiter(_this, void 0, void 0, function () {
             var _a, _b, _c;
@@ -792,6 +792,17 @@ var RemultServerImplementation = /** @class */ (function () {
                     return secureBase(condition, def, item);
                 };
                 var apiPath = (spec.paths[this_2.options.rootPath + '/' + key] = {});
+                var itemInBody = {
+                    requestBody: {
+                        content: {
+                            'application/json': {
+                                schema: {
+                                    $ref: '#/components/schemas/' + mutationKey,
+                                },
+                            },
+                        },
+                    },
+                };
                 var apiPathWithId = (spec.paths[this_2.options.rootPath + '/' + key + '/{id}'] = {});
                 //https://github.com/2fd/open-api.d.ts
                 apiPath.get = secure(meta.options.allowApiRead, true, {
@@ -843,6 +854,68 @@ var RemultServerImplementation = /** @class */ (function () {
                         },
                     },
                 });
+                apiPath.delete = secure(meta.options.allowApiDelete, true, {
+                    description: 'deletes row of ' +
+                        key +
+                        '. supports filter operators. For more info on filtering [see this article](https://remult.dev/docs/rest-api.html#filter)',
+                    parameters: tslib_1.__spreadArray([], tslib_1.__read(parameters), false),
+                    responses: {
+                        '400': {
+                            description: 'Error: Bad Request',
+                            content: {
+                                'application/json': {
+                                    schema: {
+                                        $ref: '#/components/schemas/InvalidResponse',
+                                    },
+                                },
+                            },
+                        },
+                        '200': {
+                            description: 'returns the number of deleted rows ' + key,
+                            content: {
+                                'application/json': {
+                                    schema: {
+                                        type: 'object',
+                                        properties: {
+                                            deleted: {
+                                                type: 'number',
+                                            },
+                                        },
+                                    },
+                                },
+                            },
+                        },
+                    },
+                });
+                apiPath.put = secure(meta.options.allowApiDelete, true, tslib_1.__assign(tslib_1.__assign({ description: 'updates row of ' +
+                        key +
+                        '. supports filter operators. For more info on filtering [see this article](https://remult.dev/docs/rest-api.html#filter)', parameters: tslib_1.__spreadArray([], tslib_1.__read(parameters), false) }, itemInBody), { responses: {
+                        '400': {
+                            description: 'Error: Bad Request',
+                            content: {
+                                'application/json': {
+                                    schema: {
+                                        $ref: '#/components/schemas/InvalidResponse',
+                                    },
+                                },
+                            },
+                        },
+                        '200': {
+                            description: 'returns the number of updated rows ' + key,
+                            content: {
+                                'application/json': {
+                                    schema: {
+                                        type: 'object',
+                                        properties: {
+                                            updated: {
+                                                type: 'number',
+                                            },
+                                        },
+                                    },
+                                },
+                            },
+                        },
+                    } }));
                 var idParameter = {
                     name: 'id',
                     in: 'path',
@@ -850,17 +923,6 @@ var RemultServerImplementation = /** @class */ (function () {
                     required: true,
                     schema: { type: 'string' },
                 };
-                var itemInBody = {
-                    requestBody: {
-                        content: {
-                            'application/json': {
-                                schema: {
-                                    $ref: '#/components/schemas/' + mutationKey,
-                                },
-                            },
-                        },
-                    },
-                };
                 apiPath.post = secure(meta.options.allowApiInsert, false, tslib_1.__assign(tslib_1.__assign({ 
                     //"summary": "insert a " + key,
                     //"description": "insert a " + key,

package/src/context.d.ts

@@ -92,6 +92,8 @@ export interface ApiClient {
      * @example
      * // Using Angular HttpClient
      * remult.apiClient.httpClient = httpClient;
+     * @see
+     * If you want to add headers using angular httpClient, see: https://medium.com/angular-shots/shot-3-how-to-add-http-headers-to-every-request-in-angular-fab3d10edc26
      *
      * @example
      * // Using fetch (default)

package/src/data-api.d.ts

@@ -10,18 +10,22 @@ export declare class DataApi<T = any> {
     httpPost(res: DataApiResponse, req: DataApiRequest, body: any, serializeContext: () => Promise<any>): Promise<void>;
     static defaultGetLimit: number;
     get(response: DataApiResponse, id: any): Promise<void>;
-    count(response: DataApiResponse, request: DataApiRequest, filterBody?: any): Promise<void>;
-    deleteMany(response: DataApiResponse, request: DataApiRequest, filterBody?: any): Promise<void>;
-    getArrayImpl(response: DataApiResponse, request: DataApiRequest, filterBody: any): Promise<{
+    count(response: DataApiResponse, request: DataApiRequest, body?: any): Promise<void>;
+    deleteMany(response: DataApiResponse, request: DataApiRequest, body?: any): Promise<void>;
+    getArrayImpl(response: DataApiResponse, request: DataApiRequest, body: any): Promise<{
         r: any[];
         findOptions: FindOptions<T>;
     }>;
     private includeNone;
-    getArray(response: DataApiResponse, request: DataApiRequest, filterBody?: any): Promise<void>;
-    liveQuery(response: DataApiResponse, request: DataApiRequest, filterBody: any, serializeContext: () => Promise<any>, queryChannel: string): Promise<void>;
+    getArray(response: DataApiResponse, request: DataApiRequest, body?: any): Promise<void>;
+    liveQuery(response: DataApiResponse, request: DataApiRequest, body: any, serializeContext: () => Promise<any>, queryChannel: string): Promise<void>;
     private buildWhere;
     private doOnId;
-    updateMany(response: DataApiResponse, request: DataApiRequest, body?: any): Promise<void>;
+    updateMany(response: DataApiResponse, request: DataApiRequest, body: any): Promise<void>;
+    updateManyImplementation(response: DataApiResponse, request: DataApiRequest, body: {
+        where: any;
+        set: any;
+    }): Promise<void>;
     actualUpdate(row: any, body: any): Promise<rowHelperImplementation<T>>;
     put(response: DataApiResponse, id: any, body: any): Promise<void>;
     actualDelete(row: any): Promise<void>;

package/src/data-api.js

@@ -44,7 +44,7 @@ var DataApi = /** @class */ (function () {
                     case 1: return [2 /*return*/, this.getArray(res, req, body)];
                     case 2: return [2 /*return*/, this.count(res, req, body)];
                     case 3: return [2 /*return*/, this.deleteMany(res, req, body)];
-                    case 4: return [2 /*return*/, this.updateMany(res, req, body)];
+                    case 4: return [2 /*return*/, this.updateManyImplementation(res, req, body)];
                     case 5: return [4 /*yield*/, this.remult.liveQueryStorage.remove(body.id)];
                     case 6:
                         _b.sent();
@@ -75,7 +75,7 @@ var DataApi = /** @class */ (function () {
             });
         });
     };
-    DataApi.prototype.count = function (response, request, filterBody) {
+    DataApi.prototype.count = function (response, request, body) {
         return tslib_1.__awaiter(this, void 0, void 0, function () {
             var _a, _b, _c, _d, err_1;
             var _e;
@@ -92,7 +92,7 @@ var DataApi = /** @class */ (function () {
                         _b = (_a = response).success;
                         _e = {};
                         _d = (_c = this.repository).count;
-                        return [4 /*yield*/, this.buildWhere(request, filterBody)];
+                        return [4 /*yield*/, this.buildWhere(request, body)];
                     case 2: return [4 /*yield*/, _d.apply(_c, [_f.sent()])];
                     case 3:
                         _b.apply(_a, [(_e.count = +(_f.sent()),
@@ -107,82 +107,79 @@ var DataApi = /** @class */ (function () {
             });
         });
     };
-    DataApi.prototype.deleteMany = function (response, request, filterBody) {
+    DataApi.prototype.deleteMany = function (response, request, body) {
         return tslib_1.__awaiter(this, void 0, void 0, function () {
-            var err_2;
+            var deleted_1, where_1, err_2;
             var _this = this;
             return tslib_1.__generator(this, function (_a) {
                 switch (_a.label) {
                     case 0:
-                        _a.trys.push([0, 2, , 3]);
+                        _a.trys.push([0, 3, , 4]);
+                        deleted_1 = 0;
+                        return [4 /*yield*/, this.buildWhere(request, body)];
+                    case 1:
+                        where_1 = _a.sent();
+                        filter_interfaces_js_1.Filter.throwErrorIfFilterIsEmpty(where_1, 'deleteMany');
                         return [4 /*yield*/, (0, context_js_1.doTransaction)(this.remult, function () { return tslib_1.__awaiter(_this, void 0, void 0, function () {
-                                var deleted, _a, _b, _c, _d, _e, x, e_1_1;
-                                var _f;
-                                var _g, e_1, _h, _j;
-                                return tslib_1.__generator(this, function (_k) {
-                                    switch (_k.label) {
+                                var _a, _b, _c, x, e_1_1;
+                                var _d, e_1, _e, _f;
+                                return tslib_1.__generator(this, function (_g) {
+                                    switch (_g.label) {
                                         case 0:
-                                            deleted = 0;
-                                            _k.label = 1;
-                                        case 1:
-                                            _k.trys.push([1, 8, 9, 14]);
-                                            _a = true;
-                                            _e = (_d = this.repository).query;
-                                            _f = {};
-                                            return [4 /*yield*/, this.buildWhere(request, filterBody)];
+                                            _g.trys.push([0, 6, 7, 12]);
+                                            _a = true, _b = tslib_1.__asyncValues(this.repository.query({
+                                                where: where_1,
+                                                include: this.includeNone(),
+                                            }));
+                                            _g.label = 1;
+                                        case 1: return [4 /*yield*/, _b.next()];
                                         case 2:
-                                            _b = tslib_1.__asyncValues.apply(void 0, [_e.apply(_d, [(_f.where = _k.sent(),
-                                                        _f.include = this.includeNone(),
-                                                        _f)])]);
-                                            _k.label = 3;
-                                        case 3: return [4 /*yield*/, _b.next()];
-                                        case 4:
-                                            if (!(_c = _k.sent(), _g = _c.done, !_g)) return [3 /*break*/, 7];
-                                            _j = _c.value;
+                                            if (!(_c = _g.sent(), _d = _c.done, !_d)) return [3 /*break*/, 5];
+                                            _f = _c.value;
                                             _a = false;
-                                            x = _j;
+                                            x = _f;
                                             return [4 /*yield*/, this.actualDelete(x)];
-                                        case 5:
-                                            _k.sent();
-                                            deleted++;
-                                            _k.label = 6;
-                                        case 6:
+                                        case 3:
+                                            _g.sent();
+                                            deleted_1++;
+                                            _g.label = 4;
+                                        case 4:
                                             _a = true;
-                                            return [3 /*break*/, 3];
-                                        case 7: return [3 /*break*/, 14];
-                                        case 8:
-                                            e_1_1 = _k.sent();
+                                            return [3 /*break*/, 1];
+                                        case 5: return [3 /*break*/, 12];
+                                        case 6:
+                                            e_1_1 = _g.sent();
                                             e_1 = { error: e_1_1 };
-                                            return [3 /*break*/, 14];
-                                        case 9:
-                                            _k.trys.push([9, , 12, 13]);
-                                            if (!(!_a && !_g && (_h = _b.return))) return [3 /*break*/, 11];
-                                            return [4 /*yield*/, _h.call(_b)];
+                                            return [3 /*break*/, 12];
+                                        case 7:
+                                            _g.trys.push([7, , 10, 11]);
+                                            if (!(!_a && !_d && (_e = _b.return))) return [3 /*break*/, 9];
+                                            return [4 /*yield*/, _e.call(_b)];
+                                        case 8:
+                                            _g.sent();
+                                            _g.label = 9;
+                                        case 9: return [3 /*break*/, 11];
                                         case 10:
-                                            _k.sent();
-                                            _k.label = 11;
-                                        case 11: return [3 /*break*/, 13];
-                                        case 12:
                                             if (e_1) throw e_1.error;
                                             return [7 /*endfinally*/];
-                                        case 13: return [7 /*endfinally*/];
-                                        case 14:
-                                            response.success({ deleted: deleted });
+                                        case 11: return [7 /*endfinally*/];
+                                        case 12:
+                                            response.success({ deleted: deleted_1 });
                                             return [2 /*return*/];
                                     }
                                 });
                             }); })];
-                    case 1: return [2 /*return*/, _a.sent()];
-                    case 2:
+                    case 2: return [2 /*return*/, _a.sent()];
+                    case 3:
                         err_2 = _a.sent();
                         response.error(err_2, this.repository.metadata);
-                        return [3 /*break*/, 3];
-                    case 3: return [2 /*return*/];
+                        return [3 /*break*/, 4];
+                    case 4: return [2 /*return*/];
                 }
             });
         });
     };
-    DataApi.prototype.getArrayImpl = function (response, request, filterBody) {
+    DataApi.prototype.getArrayImpl = function (response, request, body) {
         return tslib_1.__awaiter(this, void 0, void 0, function () {
             var findOptions, _a, sort, dir, limit, hasId_1, w, r;
             var _this = this;
@@ -194,7 +191,7 @@ var DataApi = /** @class */ (function () {
                             include: this.includeNone(),
                         };
                         _a = findOptions;
-                        return [4 /*yield*/, this.buildWhere(request, filterBody)];
+                        return [4 /*yield*/, this.buildWhere(request, body)];
                     case 1:
                         _a.where = _b.sent();
                         if (request) {
@@ -281,7 +278,7 @@ var DataApi = /** @class */ (function () {
         }
         return include;
     };
-    DataApi.prototype.getArray = function (response, request, filterBody) {
+    DataApi.prototype.getArray = function (response, request, body) {
         return tslib_1.__awaiter(this, void 0, void 0, function () {
             var r, err_3;
             return tslib_1.__generator(this, function (_a) {
@@ -294,7 +291,7 @@ var DataApi = /** @class */ (function () {
                         _a.label = 1;
                     case 1:
                         _a.trys.push([1, 3, , 4]);
-                        return [4 /*yield*/, this.getArrayImpl(response, request, filterBody)];
+                        return [4 /*yield*/, this.getArrayImpl(response, request, body)];
                     case 2:
                         r = (_a.sent()).r;
                         response.success(r);
@@ -311,7 +308,7 @@ var DataApi = /** @class */ (function () {
             });
         });
     };
-    DataApi.prototype.liveQuery = function (response, request, filterBody, serializeContext, queryChannel) {
+    DataApi.prototype.liveQuery = function (response, request, body, serializeContext, queryChannel) {
         return tslib_1.__awaiter(this, void 0, void 0, function () {
             var r, data, err_4;
             var _a;
@@ -326,7 +323,7 @@ var DataApi = /** @class */ (function () {
                         _b.label = 1;
                     case 1:
                         _b.trys.push([1, 5, , 6]);
-                        return [4 /*yield*/, this.getArrayImpl(response, request, filterBody)];
+                        return [4 /*yield*/, this.getArrayImpl(response, request, body)];
                     case 2:
                         r = _b.sent();
                         _a = {};
@@ -357,7 +354,7 @@ var DataApi = /** @class */ (function () {
             });
         });
     };
-    DataApi.prototype.buildWhere = function (request, filterBody) {
+    DataApi.prototype.buildWhere = function (request, body) {
         return tslib_1.__awaiter(this, void 0, void 0, function () {
             var where, _a, _b;
             return tslib_1.__generator(this, function (_c) {
@@ -387,8 +384,8 @@ var DataApi = /** @class */ (function () {
                                 },
                             }));
                         }
-                        if (filterBody)
-                            where.push(filter_interfaces_js_1.Filter.entityFilterFromJson(this.repository.metadata, filterBody));
+                        if (body === null || body === void 0 ? void 0 : body.where)
+                            where.push(filter_interfaces_js_1.Filter.entityFilterFromJson(this.repository.metadata, body.where));
                         return [2 /*return*/, { $and: where }];
                 }
             });
@@ -455,6 +452,28 @@ var DataApi = /** @class */ (function () {
         });
     };
     DataApi.prototype.updateMany = function (response, request, body) {
+        return tslib_1.__awaiter(this, void 0, void 0, function () {
+            var action, where;
+            return tslib_1.__generator(this, function (_a) {
+                switch (_a.label) {
+                    case 0:
+                        action = request === null || request === void 0 ? void 0 : request.get('__action');
+                        if (action == 'emptyId') {
+                            return [2 /*return*/, this.put(response, '', body)];
+                        }
+                        return [4 /*yield*/, this.buildWhere(request, body)];
+                    case 1:
+                        where = _a.sent();
+                        filter_interfaces_js_1.Filter.throwErrorIfFilterIsEmpty(where, 'updateMany');
+                        return [2 /*return*/, this.updateManyImplementation(response, request, {
+                                where: undefined,
+                                set: body,
+                            })];
+                }
+            });
+        });
+    };
+    DataApi.prototype.updateManyImplementation = function (response, request, body) {
         return tslib_1.__awaiter(this, void 0, void 0, function () {
             var err_6;
             var _this = this;
@@ -476,7 +495,7 @@ var DataApi = /** @class */ (function () {
                                             _a = true;
                                             _e = (_d = this.repository).query;
                                             _f = {};
-                                            return [4 /*yield*/, this.buildWhere(request, body.where)];
+                                            return [4 /*yield*/, this.buildWhere(request, body)];
                                         case 2:
                                             _b = tslib_1.__asyncValues.apply(void 0, [_e.apply(_d, [(_f.where = _k.sent(),
                                                         _f.include = this.includeNone(),

package/src/data-providers/rest-data-provider.js

@@ -165,7 +165,7 @@ var RestEntityDataProvider = /** @class */ (function () {
         return tslib_1.__awaiter(this, void 0, void 0, function () {
             var run;
             return tslib_1.__generator(this, function (_a) {
-                run = this.buildFindRequest({ where: where }, true).run;
+                run = this.buildFindRequest({ where: where }, 'delete').run;
                 return [2 /*return*/, run('deleteMany').then(function (r) { return +r.deleted; })];
             });
         });
@@ -174,8 +174,8 @@ var RestEntityDataProvider = /** @class */ (function () {
         return tslib_1.__awaiter(this, void 0, void 0, function () {
             var run;
             return tslib_1.__generator(this, function (_a) {
-                run = this.buildFindRequest({ where: where }, true).run;
-                return [2 /*return*/, run('updateMany', { set: this.toJsonOfIncludedKeys(data) }).then(function (r) { return +r.updated; })];
+                run = this.buildFindRequest({ where: where }, 'put').run;
+                return [2 /*return*/, run('updateMany', this.toJsonOfIncludedKeys(data)).then(function (r) { return +r.updated; })];
             });
         });
     };
@@ -185,16 +185,16 @@ var RestEntityDataProvider = /** @class */ (function () {
         return run().then(function (x) { return x.map(function (y) { return _this.translateFromJson(y); }); });
     };
     //@internal
-    RestEntityDataProvider.prototype.buildFindRequest = function (options, forcePost) {
+    RestEntityDataProvider.prototype.buildFindRequest = function (options, method) {
         var _this = this;
-        if (forcePost === void 0) { forcePost = false; }
+        if (!method)
+            method = 'get';
         var url = new urlBuilder_js_1.UrlBuilder(this.url());
         var filterObject;
         if (options) {
             if (options.where) {
                 filterObject = options.where.toJson(); //        options.where.__applyToConsumer(new FilterConsumnerBridgeToUrlBuilder(url));
-                if (!forcePost &&
-                    addFilterToUrlAndReturnTrueIfSuccessful(filterObject, url))
+                if (addFilterToUrlAndReturnTrueIfSuccessful(filterObject, url))
                     filterObject = undefined;
             }
             if (options.orderBy && options.orderBy.Segments) {
@@ -228,15 +228,12 @@ var RestEntityDataProvider = /** @class */ (function () {
             }
             if (action)
                 u.add('__action', action);
-            if (filterObject || forcePost) {
-                if (!body)
-                    body = filterObject;
-                else
-                    body = tslib_1.__assign(tslib_1.__assign({}, body), { where: filterObject });
+            if (filterObject) {
+                body = { set: body, where: filterObject };
                 return _this.http().post(u.url, body);
             }
             else
-                return _this.http().get(u.url);
+                return _this.http()[method](u.url, body);
         };
         return {
             createKey: function () { return JSON.stringify({ url: url, filterObject: filterObject }); },
@@ -270,7 +267,8 @@ var RestEntityDataProvider = /** @class */ (function () {
     RestEntityDataProvider.prototype.update = function (id, data) {
         var _this = this;
         return this.http()
-            .put(this.url() + '/' + encodeURIComponent(id), this.toJsonOfIncludedKeys(data))
+            .put(this.url() +
+            (id != '' ? '/' + encodeURIComponent(id) : '?__action=emptyId'), this.toJsonOfIncludedKeys(data))
             .then(function (y) { return _this.translateFromJson(y); });
     };
     RestEntityDataProvider.prototype.toJsonOfIncludedKeys = function (data) {
@@ -294,7 +292,20 @@ var RestEntityDataProvider = /** @class */ (function () {
         return result;
     };
     RestEntityDataProvider.prototype.delete = function (id) {
-        return this.http().delete(this.url() + '/' + encodeURIComponent(id));
+        return tslib_1.__awaiter(this, void 0, void 0, function () {
+            return tslib_1.__generator(this, function (_a) {
+                switch (_a.label) {
+                    case 0:
+                        if (!(id == '')) return [3 /*break*/, 2];
+                        return [4 /*yield*/, this.deleteMany(filter_interfaces_js_1.Filter.fromEntityFilter(this.entity, this.entity.idMetadata.getIdFilter(id)))];
+                    case 1:
+                        _a.sent();
+                        return [3 /*break*/, 3];
+                    case 2: return [2 /*return*/, this.http().delete(this.url() + '/' + encodeURIComponent(id))];
+                    case 3: return [2 /*return*/];
+                }
+            });
+        });
     };
     RestEntityDataProvider.prototype.insert = function (data) {
         var _this = this;

package/src/filter/filter-interfaces.js

@@ -12,6 +12,58 @@ var Filter = /** @class */ (function () {
     function Filter(apply) {
         this.apply = apply;
     }
+    //@internal
+    Filter.throwErrorIfFilterIsEmpty = function (where, methodName) {
+        if (Filter.isFilterEmpty(where)) {
+            throw {
+                message: "".concat(methodName, ": requires a filter to protect against accidental delete/update of all rows"),
+                httpStatusCode: 400,
+            };
+        }
+    };
+    //@internal
+    Filter.isFilterEmpty = function (where) {
+        var e_1, _a, e_2, _b;
+        if (where.$and) {
+            try {
+                for (var _c = tslib_1.__values(where.$and), _d = _c.next(); !_d.done; _d = _c.next()) {
+                    var a = _d.value;
+                    if (!Filter.isFilterEmpty(a)) {
+                        return false;
+                    }
+                }
+            }
+            catch (e_1_1) { e_1 = { error: e_1_1 }; }
+            finally {
+                try {
+                    if (_d && !_d.done && (_a = _c.return)) _a.call(_c);
+                }
+                finally { if (e_1) throw e_1.error; }
+            }
+        }
+        if (where.$or) {
+            try {
+                for (var _e = tslib_1.__values(where.$or), _f = _e.next(); !_f.done; _f = _e.next()) {
+                    var a = _f.value;
+                    if (Filter.isFilterEmpty(a)) {
+                        return true;
+                    }
+                }
+            }
+            catch (e_2_1) { e_2 = { error: e_2_1 }; }
+            finally {
+                try {
+                    if (_f && !_f.done && (_b = _e.return)) _b.call(_e);
+                }
+                finally { if (e_2) throw e_2.error; }
+            }
+            return false;
+        }
+        if (Object.keys(where).filter(function (x) { return !['$or', '$and'].includes(x); }).length == 0) {
+            return true;
+        }
+        return false;
+    };
     Filter.createCustom = function (rawFilterTranslator, key) {
         if (key === void 0) { key = ''; }
         var rawFilterInfo = { key: key, rawFilterTranslator: rawFilterTranslator };
@@ -317,19 +369,19 @@ var filterHelper = /** @class */ (function () {
     filterHelper.prototype.isNotIn = function (values) {
         var _this = this;
         return new Filter(function (add) {
-            var e_1, _a;
+            var e_3, _a;
             try {
                 for (var values_1 = tslib_1.__values(values), values_1_1 = values_1.next(); !values_1_1.done; values_1_1 = values_1.next()) {
                     var v = values_1_1.value;
                     add.isDifferentFrom(_this.metadata, _this.processVal(v));
                 }
             }
-            catch (e_1_1) { e_1 = { error: e_1_1 }; }
+            catch (e_3_1) { e_3 = { error: e_3_1 }; }
             finally {
                 try {
                     if (values_1_1 && !values_1_1.done && (_a = values_1.return)) _a.call(values_1);
                 }
-                finally { if (e_1) throw e_1.error; }
+                finally { if (e_3) throw e_3.error; }
             }
         });
     };
@@ -462,7 +514,7 @@ var AndFilter = /** @class */ (function (_super) {
             filters[_i] = arguments[_i];
         }
         var _this = _super.call(this, function (add) {
-            var e_2, _a;
+            var e_4, _a;
             try {
                 for (var _b = tslib_1.__values(_this.filters), _c = _b.next(); !_c.done; _c = _b.next()) {
                     var iterator = _c.value;
@@ -470,12 +522,12 @@ var AndFilter = /** @class */ (function (_super) {
                         iterator.__applyToConsumer(add);
                 }
             }
-            catch (e_2_1) { e_2 = { error: e_2_1 }; }
+            catch (e_4_1) { e_4 = { error: e_4_1 }; }
             finally {
                 try {
                     if (_c && !_c.done && (_a = _b.return)) _a.call(_b);
                 }
-                finally { if (e_2) throw e_2.error; }
+                finally { if (e_4) throw e_4.error; }
             }
         }) || this;
         _this.filters = filters;
@@ -595,7 +647,7 @@ function buildFilterFromRequestParameters(entity, filterInfo) {
     tslib_1.__spreadArray([], tslib_1.__read(entity.fields), false).forEach(function (col) {
         var _a, _b;
         function addFilter(operation, theFilter, jsonArray, asString) {
-            var e_3, _a;
+            var e_5, _a;
             if (jsonArray === void 0) { jsonArray = false; }
             if (asString === void 0) { asString = false; }
             var val = filterInfo.get(col.key + operation);
@@ -638,12 +690,12 @@ function buildFilterFromRequestParameters(entity, filterInfo) {
                             addFilter_1(x);
                         }
                     }
-                    catch (e_3_1) { e_3 = { error: e_3_1 }; }
+                    catch (e_5_1) { e_5 = { error: e_5_1 }; }
                     finally {
                         try {
                             if (array_1_1 && !array_1_1.done && (_a = array_1.return)) _a.call(array_1);
                         }
-                        finally { if (e_3) throw e_3.error; }
+                        finally { if (e_5) throw e_5.error; }
                     }
                 }
             }
@@ -717,7 +769,7 @@ function buildFilterFromRequestParameters(entity, filterInfo) {
         return where[0];
     return { $and: where };
     function separateArrayFromInnerArray(val) {
-        var e_4, _a;
+        var e_6, _a;
         if (!Array.isArray(val))
             return [val];
         var nonArray = [], array = [];
@@ -731,12 +783,12 @@ function buildFilterFromRequestParameters(entity, filterInfo) {
                     nonArray.push(v);
             }
         }
-        catch (e_4_1) { e_4 = { error: e_4_1 }; }
+        catch (e_6_1) { e_6 = { error: e_6_1 }; }
         finally {
             try {
                 if (val_1_1 && !val_1_1.done && (_a = val_1.return)) _a.call(val_1);
             }
-            finally { if (e_4) throw e_4.error; }
+            finally { if (e_6) throw e_6.error; }
         }
         array.push(nonArray);
         return array;

package/src/remult3/RepositoryImplementation.js

@@ -442,6 +442,7 @@ var RepositoryImplementation = /** @class */ (function () {
             return tslib_1.__generator(this, function (_j) {
                 switch (_j.label) {
                     case 0:
+                        filter_interfaces_js_1.Filter.throwErrorIfFilterIsEmpty(where, 'updateMany');
                         if (!this._dataProvider.isProxy) return [3 /*break*/, 2];
                         _e = (_d = this._edp).updateMany;
                         return [4 /*yield*/, this._translateWhereToFilter(where)];
@@ -1093,6 +1094,7 @@ var RepositoryImplementation = /** @class */ (function () {
             return tslib_1.__generator(this, function (_j) {
                 switch (_j.label) {
                     case 0:
+                        filter_interfaces_js_1.Filter.throwErrorIfFilterIsEmpty(where, 'deleteMany');
                         if (!this._dataProvider.isProxy) return [3 /*break*/, 2];
                         _e = (_d = this._edp).deleteMany;
                         return [4 /*yield*/, this._translateWhereToFilter(where)];

package/src/remult3/remult3.js

@@ -1,17 +1,11 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
+//y1 - reconsider adding where to all in case of post - it is a breaking change and no longer required
+//y1 - review that with deleteMany, and updateMany I've taken a similar approach to get, that when the filter is complex, we go to post - one reason is that delete doesn't accept a body.
+//y1 - should the remult api be deleteMany({id:[1,2]}) or deleteMany({where:{id:[1,2]}})
 //p1 - in this video I'll use remult to turn a frontend app to a fullstack app
-/*p1 - discuss using delete & put - with url query language for deleteMany and updateMany -
-- put & delete, similar to get
-- add where to count, deleteMany,updateMany,
-- prevent delete all and update all - must have meaningful where.
-- try forcing this also in typescript
-
-- protect against deleting of all rows by mistake
-- https://github.com/remult/remult/issues/221#issuecomment-2016519746
-
-*/
 //y1 - getFields didn't work for kobi in the home component
+//y1 - consider replacing all errors with error classes that extend the base Error class
 //p1 - document offline support
 //p1 - add section to Fields doc, explaining field type in db
 //p1 - add section about union type

package/src/valueConverters.js

@@ -138,7 +138,7 @@ var ValueConverters = /** @class */ (function () {
         toJson: function (value) { return ValueConverters.Number.toDb(value); },
         fromInput: function (x, type) {
             var r = +x;
-            if (!x)
+            if (x === null || x === undefined)
                 return undefined;
             return r;
         },