remult 3.3.19-next.1 → 3.3.19-next.3

package/esm/src/data-providers/in-memory-database.js

@@ -1,3 +1,4 @@
+import { getEntityMetadata, } from '../remult3/RepositoryImplementation.js';
 import { ArrayEntityDataProvider } from './array-entity-data-provider.js';
 export class InMemoryDataProvider {
     async transaction(action) {
@@ -15,7 +16,17 @@ export class InMemoryDataProvider {
         let name = entity.dbName;
         if (!this.rows[name])
             this.rows[name] = [];
-        return new ArrayEntityDataProvider(entity, () => this.rows[name]);
+        return new ArrayEntityDataProvider(entity, () => {
+            if (!this.rows[name])
+                this.rows[name] = [];
+            return this.rows[name];
+        });
+    }
+    async dropDatabase() {
+        this.rows = {};
+    }
+    async dropTable(entity) {
+        delete this.rows[getEntityMetadata(entity).dbName];
     }
     toString() {
         return 'InMemoryDataProvider';

package/esm/src/data-providers/indexed-db-data-provider.js

@@ -1,5 +1,5 @@
 import { dbNamesOf, isDbReadonly, } from '../filter/filter-consumer-bridge-to-sql-request.js';
-import { isAutoIncrement } from '../remult3/RepositoryImplementation.js';
+import { getEntityMetadata, isAutoIncrement, } from '../remult3/RepositoryImplementation.js';
 import { ArrayEntityDataProvider } from './array-entity-data-provider.js';
 export class IndexedDbIndexBuilder {
     //@internal
@@ -9,12 +9,27 @@ export class IndexedDbIndexBuilder {
         return this;
     }
 }
+const IDB_KEYS_STORE = '__remult_keys';
+const IDB_DEK_ID = 'dek';
+const IDB_ENC = '_enc';
+const IDB_IV = '_iv';
 export class IndexedDbDataProvider {
     dbName;
     //@internal
     declaredIndexes = [];
+    //@internal
+    encrypt;
+    //@internal
+    customGetKey;
+    //@internal
+    dek;
     constructor(dbName = 'remult', options) {
         this.dbName = dbName;
+        this.encrypt = options?.encrypt === true;
+        this.customGetKey = options?.getEncryptionKey;
+        if (this.encrypt && !(typeof crypto !== 'undefined' && crypto.subtle)) {
+            throw new Error('Web Crypto API is required when IndexedDB encryption is enabled');
+        }
         if (options?.indexes) {
             const builder = new IndexedDbIndexBuilder();
             options.indexes(builder);
@@ -40,6 +55,29 @@ export class IndexedDbDataProvider {
         this.db?.close();
         this.db = undefined;
     }
+    async dropDatabase() {
+        await this.enqueue(async () => {
+            this.close();
+            this.dek = undefined;
+            await idbDeleteDatabase(this.dbName);
+        });
+    }
+    async dropTable(entity) {
+        await this.enqueue(async () => {
+            const name = storeNameOf(getEntityMetadata(entity));
+            const db = await this.open();
+            if (!db.objectStoreNames.contains(name))
+                return;
+            const nextVersion = db.version + 1;
+            this.forget(db);
+            db.close();
+            await this.open(nextVersion, (upgradeDb) => {
+                if (upgradeDb.objectStoreNames.contains(name)) {
+                    upgradeDb.deleteObjectStore(name);
+                }
+            });
+        });
+    }
     //@internal
     enqueue(fn) {
         const run = this.tail.then(fn, fn);
@@ -66,10 +104,14 @@ export class IndexedDbDataProvider {
         const storeName = storeNameOf(entity);
         const prefetch = await idbPrefetchFromFilter(entity, where, this.storeIndexes(storeName));
         this.lastFetch = prefetch;
-        if (prefetch.type === 'all')
-            return this.getAll(storeName);
-        const ops = prefetch.type === 'or' ? prefetch.parts : [prefetch];
-        return this.fetchOps(storeName, entity, ops);
+        const rows = prefetch.type === 'all'
+            ? await this.getAll(storeName)
+            : await this.fetchOps(storeName, entity, prefetch.type === 'or' ? prefetch.parts : [prefetch]);
+        if (!this.encrypt)
+            return rows;
+        const dek = await this.loadDek();
+        const names = await dbNamesOf(entity, (x) => x);
+        return Promise.all(rows.map((row) => decryptJson(storeName, row, entity, names, dek)));
     }
     //@internal
     storeIndexes(storeName) {
@@ -106,18 +148,24 @@ export class IndexedDbDataProvider {
             };
         }));
         const db = await this.open();
-        const needsUpgrade = wanted.some((w) => {
-            if (!db.objectStoreNames.contains(w.name))
-                return true;
-            const existing = this.storeIndexes(w.name).map((i) => i.name);
-            return w.indexes.some((idx) => !existing.includes(idx.name));
-        });
+        const needsKeyStore = this.usesKeyStore() && !db.objectStoreNames.contains(IDB_KEYS_STORE);
+        const needsUpgrade = needsKeyStore ||
+            wanted.some((w) => {
+                if (!db.objectStoreNames.contains(w.name))
+                    return true;
+                const existing = this.storeIndexes(w.name).map((i) => i.name);
+                return w.indexes.some((idx) => !existing.includes(idx.name));
+            });
         if (!needsUpgrade)
             return;
         const nextVersion = db.version + 1;
         this.forget(db);
         db.close();
         await this.open(nextVersion, (upgradeDb, tx) => {
+            if (this.usesKeyStore() &&
+                !upgradeDb.objectStoreNames.contains(IDB_KEYS_STORE)) {
+                upgradeDb.createObjectStore(IDB_KEYS_STORE, { keyPath: 'id' });
+            }
             for (const { name, keyPath, autoIncrement, indexes } of wanted) {
                 const store = upgradeDb.objectStoreNames.contains(name)
                     ? tx.objectStore(name)
@@ -131,6 +179,63 @@ export class IndexedDbDataProvider {
         });
     }
     //@internal
+    usesKeyStore() {
+        return this.encrypt && !this.customGetKey;
+    }
+    //@internal
+    async loadDek() {
+        if (this.dek)
+            return this.dek;
+        if (this.customGetKey) {
+            const key = await this.customGetKey();
+            this.dek = key;
+            return key;
+        }
+        const existing = await this.withStore(IDB_KEYS_STORE, 'readonly', (s) => idbReq(s.get(IDB_DEK_ID)));
+        if (existing?.key) {
+            this.dek = existing.key;
+            return existing.key;
+        }
+        const generated = await crypto.subtle.generateKey({ name: 'AES-GCM', length: 256 }, false, ['encrypt', 'decrypt']);
+        const key = await this.withStore(IDB_KEYS_STORE, 'readwrite', async (s) => {
+            const rec = await idbReq(s.get(IDB_DEK_ID));
+            if (rec?.key)
+                return rec.key;
+            try {
+                await idbReq(s.add({ id: IDB_DEK_ID, key: generated }));
+                return generated;
+            }
+            catch (e) {
+                if (e?.name === 'ConstraintError') {
+                    const again = await idbReq(s.get(IDB_DEK_ID));
+                    if (!again?.key)
+                        throw new Error('Failed to load IndexedDB encryption key');
+                    return again.key;
+                }
+                throw e;
+            }
+        });
+        this.dek = key;
+        return key;
+    }
+    //@internal
+    async plaintextDbNames(entity) {
+        const names = await dbNamesOf(entity, (x) => x);
+        const set = new Set();
+        for (const f of entity.idMetadata.fields) {
+            set.add(names.$dbNameOf(f));
+        }
+        for (const def of this.indexesFor(entity)) {
+            const keys = Array.isArray(def) ? [...def] : [def];
+            for (const key of keys) {
+                const field = [...entity.fields].find((f) => f.key === key);
+                if (field)
+                    set.add(names.$dbNameOf(field));
+            }
+        }
+        return set;
+    }
+    //@internal
     forget(db) {
         if (this.db === db)
             this.db = undefined;
@@ -246,23 +351,48 @@ class IndexedDbEntityDataProvider {
                     delete json[idName];
                 return json;
             });
-            return this.provider.withStore(storeNameOf(this.entity), 'readwrite', async (store) => {
-                const result = [];
-                for (const json of rows) {
+            const storeName = storeNameOf(this.entity);
+            const dek = this.provider.encrypt
+                ? await this.provider.loadDek()
+                : undefined;
+            const keep = dek
+                ? await this.provider.plaintextDbNames(this.entity)
+                : undefined;
+            if (dek && auto) {
+                const keys = await this.provider.withStore(storeName, 'readwrite', async (store) => {
+                    const allocated = [];
+                    for (let i = 0; i < rows.length; i++) {
+                        allocated.push(await idbReq(store.add({})));
+                    }
+                    return allocated;
+                });
+                for (let i = 0; i < rows.length; i++) {
+                    rows[i][idName] = keys[i];
+                }
+            }
+            const toWrite = dek
+                ? await Promise.all(rows.map((json) => encryptJson(storeName, json, keep, keyFromRow(this.entity, names, json), dek)))
+                : rows;
+            await this.provider.withStore(storeName, 'readwrite', async (store) => {
+                for (let i = 0; i < toWrite.length; i++) {
                     try {
-                        const key = await idbReq(store.add(json));
-                        if (auto)
-                            json[idName] = json[idName] ?? key;
+                        if (dek && auto) {
+                            await idbReq(store.put(toWrite[i]));
+                        }
+                        else {
+                            const key = await idbReq(store.add(toWrite[i]));
+                            if (auto)
+                                rows[i][idName] = rows[i][idName] ?? key;
+                        }
                     }
                     catch (e) {
                         if (e?.name === 'ConstraintError')
                             throw Error('id already exists');
                         throw e;
                     }
-                    result.push(helper.translateFromJson(json, names));
                 }
-                return result;
             });
+            return rows.map((json) => helper.translateFromJson(json, names));
         });
     }
     update(id, data) {
@@ -271,28 +401,38 @@ class IndexedDbEntityDataProvider {
             const helper = new ArrayEntityDataProvider(this.entity, () => []);
             const names = await helper.init();
             const key = toIdbKey(this.entity, id);
-            return this.provider.withStore(storeNameOf(this.entity), 'readwrite', async (store) => {
-                const existing = await idbReq(store.get(key));
-                if (existing == null)
-                    throw new Error(`Couldn't find row with id "${id}" in entity "${this.entity.key}" to update`);
-                const json = { ...existing };
-                const keys = Object.keys(data);
-                for (const f of this.entity.fields) {
-                    if (!isDbReadonly(f, names) && keys.includes(f.key)) {
-                        json[names.$dbNameOf(f)] = f.valueConverter.toJson(data[f.key]);
-                    }
+            const storeName = storeNameOf(this.entity);
+            const existingRaw = await this.provider.withStore(storeName, 'readonly', (store) => idbReq(store.get(key)));
+            if (existingRaw == null)
+                throw new Error(`Couldn't find row with id "${id}" in entity "${this.entity.key}" to update`);
+            const dek = this.provider.encrypt
+                ? await this.provider.loadDek()
+                : undefined;
+            const existing = dek
+                ? await decryptJson(storeName, existingRaw, this.entity, names, dek)
+                : existingRaw;
+            const json = { ...existing };
+            const keys = Object.keys(data);
+            for (const f of this.entity.fields) {
+                if (!isDbReadonly(f, names) && keys.includes(f.key)) {
+                    json[names.$dbNameOf(f)] = f.valueConverter.toJson(data[f.key]);
                 }
-                helper.verifyThatRowHasAllNotNullColumns(json, names);
-                const newKey = keyFromRow(this.entity, names, json);
+            }
+            helper.verifyThatRowHasAllNotNullColumns(json, names);
+            const newKey = keyFromRow(this.entity, names, json);
+            const toWrite = dek
+                ? await encryptJson(storeName, json, await this.provider.plaintextDbNames(this.entity), newKey, dek)
+                : json;
+            await this.provider.withStore(storeName, 'readwrite', async (store) => {
                 if (!idbKeysEqual(key, newKey)) {
                     const conflict = await idbReq(store.get(newKey));
                     if (conflict != null)
                         throw Error('id already exists');
                     await idbReq(store.delete(key));
                 }
-                await idbReq(store.put(json));
-                return helper.translateFromJson(json, names);
+                await idbReq(store.put(toWrite));
             });
+            return helper.translateFromJson(json, names);
         });
     }
     delete(ids) {
@@ -642,3 +782,63 @@ function idbReq(request) {
         request.onerror = () => reject(request.error);
     });
 }
+function idbDeleteDatabase(name) {
+    return new Promise((resolve, reject) => {
+        const req = indexedDB.deleteDatabase(name);
+        req.onsuccess = () => resolve();
+        req.onerror = () => reject(req.error);
+        req.onblocked = () => {
+            /* wait for onsuccess after other connections close */
+        };
+    });
+}
+function encAad(storeName, id) {
+    return new TextEncoder().encode(storeName + '\0' + JSON.stringify(id));
+}
+function asBufferSource(value, label) {
+    if (value instanceof Uint8Array || value instanceof ArrayBuffer)
+        return value;
+    throw new Error(`Failed to decrypt IndexedDB row: missing ${label}`);
+}
+async function encryptJson(storeName, json, plaintext, idbKey, dek) {
+    const stored = {};
+    const payload = {};
+    for (const k of Object.keys(json)) {
+        if (k === IDB_ENC || k === IDB_IV)
+            continue;
+        if (plaintext.has(k))
+            stored[k] = json[k];
+        else
+            payload[k] = json[k];
+    }
+    const iv = crypto.getRandomValues(new Uint8Array(12));
+    stored[IDB_ENC] = await crypto.subtle.encrypt({
+        name: 'AES-GCM',
+        iv,
+        additionalData: encAad(storeName, idbKey),
+    }, dek, new TextEncoder().encode(JSON.stringify(payload)));
+    stored[IDB_IV] = iv;
+    return stored;
+}
+async function decryptJson(storeName, row, entity, names, dek) {
+    if (row == null || row[IDB_ENC] == null)
+        return row;
+    const idbKey = keyFromRow(entity, names, row);
+    try {
+        const plain = await crypto.subtle.decrypt({
+            name: 'AES-GCM',
+            iv: asBufferSource(row[IDB_IV], IDB_IV),
+            additionalData: encAad(storeName, idbKey),
+        }, dek, asBufferSource(row[IDB_ENC], IDB_ENC));
+        const payload = JSON.parse(new TextDecoder().decode(plain));
+        const result = { ...row, ...payload };
+        delete result[IDB_ENC];
+        delete result[IDB_IV];
+        return result;
+    }
+    catch (e) {
+        if (e?.message?.startsWith('Failed to decrypt IndexedDB row'))
+            throw e;
+        throw new Error(`Failed to decrypt IndexedDB row in "${storeName}"`);
+    }
+}

package/esm/src/remult3/RepositoryImplementation.js

@@ -323,6 +323,14 @@ export class RepositoryImplementation {
     }
     async insert(entity, options) {
         if (Array.isArray(entity)) {
+            if (!options?.bulk) {
+                const r = [];
+                for (const item of entity)
+                    r.push(await this.insert(item, options));
+                if (options?.select === 'none')
+                    return undefined;
+                return r;
+            }
             let refs = [];
             let raw = [];
             for (const item of entity) {

package/index.d.ts

@@ -23,7 +23,7 @@ export { IdEntity } from './src/remult3/IdEntity.js';
 export { describeClass, describeBackendMethods, describeEntity, } from './src/remult3/classDescribers.js';
 export type { EntityOptions, PreprocessFilterEvent } from './src/entity.js';
 export { EntityError } from './src/data-interfaces.js';
-export type { DataProvider, EntityDataProvider, EntityDataProviderGroupByOptions, EntityDataProviderFindOptions, ErrorInfo, RestDataProviderHttpProvider, } from './src/data-interfaces.js';
+export type { DataProvider, DroppableDataProvider, EntityDataProvider, EntityDataProviderGroupByOptions, EntityDataProviderFindOptions, ErrorInfo, RestDataProviderHttpProvider, } from './src/data-interfaces.js';
 export type { SqlCommand, SqlCommandWithParameters, SqlImplementation, SqlResult, } from './src/sql-command.js';
 export type { FieldMetadata, FieldOptions, FieldValidator, ValueConverter, ValueListItem, // reconsider, maybe it should go to remult angular as the abstraction ?
 ValueOrExpression, } from './src/column-interfaces.js';

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "remult",
-    "version": "3.3.19-next.1",
+    "version": "3.3.19-next.3",
     "description": "A CRUD framework for full-stack TypeScript",
     "homepage": "https://remult.dev",
     "repository": {

package/src/data-interfaces.d.ts

@@ -1,6 +1,7 @@
 import type { FieldMetadata } from '../index.js';
 import type { Filter } from './filter/filter-interfaces.js';
 import type { GroupByOperators, EntityMetadata, MembersOnly, InsertOrUpdateOptions } from './remult3/remult3.js';
+import type { EntityMetadataOverloads } from './remult3/RepositoryImplementation.js';
 import { Sort } from './sort.js';
 export interface DataProvider {
     getEntityDataProvider(entity: EntityMetadata): EntityDataProvider;
@@ -8,6 +9,12 @@ export interface DataProvider {
     ensureSchema?(entities: EntityMetadata[]): Promise<void>;
     isProxy?: boolean;
 }
+/** `InMemoryDataProvider` + `IndexedDbDataProvider` — swap in tests. */
+export interface DroppableDataProvider extends DataProvider {
+    dropDatabase(): Promise<void>;
+    /** Recreated with indexes on next use (`ensureSchema` / first write). */
+    dropTable(entity: EntityMetadataOverloads): Promise<void>;
+}
 export interface Storage {
     ensureSchema(): Promise<void>;
 }

package/src/data-providers/in-memory-database.d.ts

@@ -1,9 +1,12 @@
 import type { __RowsOfDataForTesting } from '../__RowsOfDataForTesting.js';
-import type { DataProvider, EntityDataProvider } from '../data-interfaces.js';
+import type { DataProvider, DroppableDataProvider, EntityDataProvider } from '../data-interfaces.js';
+import { type EntityMetadataOverloads } from '../remult3/RepositoryImplementation.js';
 import type { EntityMetadata } from '../remult3/remult3.js';
-export declare class InMemoryDataProvider implements DataProvider, __RowsOfDataForTesting {
+export declare class InMemoryDataProvider implements DroppableDataProvider, __RowsOfDataForTesting {
     transaction(action: (dataProvider: DataProvider) => Promise<void>): Promise<void>;
     rows: any;
     getEntityDataProvider(entity: EntityMetadata): EntityDataProvider;
+    dropDatabase(): Promise<void>;
+    dropTable(entity: EntityMetadataOverloads): Promise<void>;
     toString(): string;
 }

package/src/data-providers/in-memory-database.js

@@ -2,6 +2,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.InMemoryDataProvider = void 0;
 var tslib_1 = require("tslib");
+var RepositoryImplementation_js_1 = require("../remult3/RepositoryImplementation.js");
 var array_entity_data_provider_js_1 = require("./array-entity-data-provider.js");
 var InMemoryDataProvider = /** @class */ (function () {
     function InMemoryDataProvider() {
@@ -35,7 +36,27 @@ var InMemoryDataProvider = /** @class */ (function () {
         var name = entity.dbName;
         if (!this.rows[name])
             this.rows[name] = [];
-        return new array_entity_data_provider_js_1.ArrayEntityDataProvider(entity, function () { return _this.rows[name]; });
+        return new array_entity_data_provider_js_1.ArrayEntityDataProvider(entity, function () {
+            if (!_this.rows[name])
+                _this.rows[name] = [];
+            return _this.rows[name];
+        });
+    };
+    InMemoryDataProvider.prototype.dropDatabase = function () {
+        return tslib_1.__awaiter(this, void 0, void 0, function () {
+            return tslib_1.__generator(this, function (_a) {
+                this.rows = {};
+                return [2 /*return*/];
+            });
+        });
+    };
+    InMemoryDataProvider.prototype.dropTable = function (entity) {
+        return tslib_1.__awaiter(this, void 0, void 0, function () {
+            return tslib_1.__generator(this, function (_a) {
+                delete this.rows[(0, RepositoryImplementation_js_1.getEntityMetadata)(entity).dbName];
+                return [2 /*return*/];
+            });
+        });
     };
     InMemoryDataProvider.prototype.toString = function () {
         return 'InMemoryDataProvider';

package/src/data-providers/indexed-db-data-provider.d.ts

@@ -1,20 +1,44 @@
-import type { DataProvider, EntityDataProvider } from '../data-interfaces.js';
+import type { DataProvider, DroppableDataProvider, EntityDataProvider } from '../data-interfaces.js';
 import type { ClassType } from '../../classType.js';
 import type { EntityMetadata, MembersOnly } from '../remult3/remult3.js';
+import { type EntityMetadataOverloads } from '../remult3/RepositoryImplementation.js';
 export type IndexedDbIndexDef<entityType> = keyof MembersOnly<entityType> | readonly (keyof MembersOnly<entityType>)[];
 export declare class IndexedDbIndexBuilder {
     ensureIndexes<entityType>(entity: ClassType<entityType>, indexes: readonly IndexedDbIndexDef<entityType>[]): this;
 }
 export type IndexedDbDataProviderOptions = {
+    /** IDB-only indexes (not unique). PK is skipped. Compound names join db names with `_`. */
     indexes?: (x: IndexedDbIndexBuilder) => void;
+    /**
+     * AES-GCM 256 on non-indexed fields (`_enc` + `_iv`). Requires `crypto.subtle`.
+     *
+     * Not full security. Stops casual disk/profile dump and other origins
+     * (non-extractable `CryptoKey` wrapped by the browser). Does **not** protect
+     * against same-origin XSS / any JS that can use the stored `CryptoKey` to decrypt.
+     *
+     * PK + `ensureIndexes` fields stay plaintext (required for IDB keyPath/indexes).
+     * Only non-indexed fields go into `_enc`.
+     *
+     * Default auto-key is origin-bound theater vs XSS. Pass `getEncryptionKey` for
+     * a stronger secret you control.
+     */
+    encrypt?: boolean;
+    /**
+     * Your AES-GCM `CryptoKey` (or Promise). Skips `__remult_keys`. Stronger than
+     * the default origin-bound auto-key — still not XSS-safe if same-origin JS can
+     * call this and decrypt.
+     */
+    getEncryptionKey?: () => CryptoKey | Promise<CryptoKey>;
 };
-export declare class IndexedDbDataProvider implements DataProvider {
+export declare class IndexedDbDataProvider implements DroppableDataProvider {
     private dbName;
     constructor(dbName?: string, options?: IndexedDbDataProviderOptions);
     getEntityDataProvider(entity: EntityMetadata): EntityDataProvider;
     transaction(action: (dataProvider: DataProvider) => Promise<void>): Promise<void>;
     ensureSchema(entities: EntityMetadata[]): Promise<void>;
     close(): void;
+    dropDatabase(): Promise<void>;
+    dropTable(entity: EntityMetadataOverloads): Promise<void>;
 }
 export type IdbFetchOp = {
     type: 'keys';