remult 3.3.19-next.3 → 3.4.0-next.10

package/esm/src/data-api.js

@@ -2,6 +2,7 @@ import { doTransaction } from './context.js';
 import { EntityError } from './data-interfaces.js';
 import { findOptionsToJson, liveQueryAction, } from './data-providers/rest-data-provider.js';
 import { Filter, buildFilterFromRequestParameters, customUrlToken, } from './filter/filter-interfaces.js';
+import { omitFilterField, walkFilter } from './filter/walk-filter.js';
 import { getRelationFieldInfo } from './remult3/relationInfoMember.js';
 import { GroupByCountMember, GroupByForApiKey, } from './remult3/remult3.js';
 import { ForbiddenError } from './server-action.js';
@@ -12,7 +13,7 @@ export class DataApi {
         this.repository = repository;
         this.remult = remult;
     }
-    httpGet(res, req, serializeContext) {
+    async httpGet(res, req, serializeContext) {
         try {
             const action = req?.get('__action');
             if (action?.startsWith(liveQueryAction))
@@ -22,15 +23,12 @@ export class DataApi {
                 case 'count':
                     return this.count(res, req, undefined);
                 case 'groupBy':
-                    return res.success(this.groupBy(req, undefined));
+                    return res.success(await this.groupBy(req, undefined));
             }
             return this.getArray(res, req, undefined);
         }
         catch (err) {
-            if (err.isForbiddenError)
-                res.forbidden(err);
-            else
-                res.error(err, this.repository.metadata);
+            this.handleError(res, err);
         }
     }
     async httpPost(res, req, body, serializeContext) {
@@ -70,16 +68,13 @@ export class DataApi {
                     res.success('ok');
                     return;
                 case 'query':
-                    return res.success(await this.query(res, req, body));
+                    return this.query(res, req, body);
                 default:
                     return res.created(await this.post(body, req));
             }
         }
         catch (err) {
-            if (err.isForbiddenError)
-                res.forbidden(err.message);
-            else
-                res.error(err, this.repository.metadata);
+            this.handleError(res, err);
         }
     }
     async upsertMany(response, request, body) {
@@ -124,16 +119,13 @@ export class DataApi {
                 this.getArrayImpl(request, rest),
                 this.groupBy(aggregateRequest, { ...aggregate, where: body.where }),
             ]);
-            return {
+            return response.success({
                 items: r,
                 aggregates,
-            };
+            });
         }
         catch (err) {
-            if (err.isForbiddenError)
-                response.forbidden();
-            else
-                response.error(err, this.repository.metadata);
+            this.handleError(response, err);
         }
     }
     static defaultGetLimit = 0;
@@ -155,7 +147,7 @@ export class DataApi {
             });
         }
         catch (err) {
-            response.error(err, this.repository.metadata);
+            this.handleError(response, err);
         }
     }
     async deleteMany(response, request, body) {
@@ -175,7 +167,7 @@ export class DataApi {
             });
         }
         catch (err) {
-            response.error(err, this.repository.metadata);
+            this.handleError(response, err);
         }
     }
     async prepareWhereForManyOperation(body, request) {
@@ -196,7 +188,7 @@ export class DataApi {
             for (const element of body?.orderBy) {
                 const direction = element.isDescending ? 'desc' : 'asc';
                 if (element.operation !== 'count' &&
-                    !this.repository.fields.find(element.field)?.includedInApi())
+                    !this.fieldIsInApi(element.field))
                     continue;
                 switch (element.operation) {
                     case undefined:
@@ -214,9 +206,9 @@ export class DataApi {
                 }
             }
         }
-        const group = body?.groupBy?.filter((x) => this.repository.fields.find(x).includedInApi());
-        const min = body?.min?.filter((x) => this.repository.fields.find(x).includedInApi());
-        const max = body?.max?.filter((x) => this.repository.fields.find(x).includedInApi());
+        const group = this.fieldsInApi(body?.groupBy);
+        const min = this.fieldsInApi(body?.min);
+        const max = this.fieldsInApi(body?.max);
         let result = await this.repository.groupBy({
             where: findOptions.where,
             limit: findOptions.limit,
@@ -224,11 +216,11 @@ export class DataApi {
             //@ts-expect-error internal key
             [GroupByForApiKey]: true,
             group,
-            sum: body?.sum?.filter((x) => this.repository.fields.find(x).includedInApi()),
-            avg: body?.avg?.filter((x) => this.repository.fields.find(x).includedInApi()),
+            sum: this.fieldsInApi(body?.sum),
+            avg: this.fieldsInApi(body?.avg),
             min,
             max,
-            distinctCount: body?.distinctCount?.filter((x) => this.repository.fields.find(x).includedInApi()),
+            distinctCount: this.fieldsInApi(body?.distinctCount),
             orderBy: orderBy,
         });
         if (group)
@@ -269,7 +261,7 @@ export class DataApi {
             let sort = request.get('_sort');
             if (sort != undefined) {
                 let dir = request.get('_order');
-                findOptions.orderBy = determineSort(sort, dir);
+                findOptions.orderBy = this.omitFieldsHiddenFromApi(determineSort(sort, dir));
             }
             let limit = +request.get('_limit');
             if (!limit && DataApi.defaultGetLimit)
@@ -341,10 +333,7 @@ export class DataApi {
             response.success(r);
         }
         catch (err) {
-            if (err.isForbiddenError)
-                response.forbidden(err.message);
-            else
-                response.error(err, this.repository.metadata);
+            this.handleError(response, err);
         }
     }
     async liveQuery(response, request, body, serializeContext, queryChannel) {
@@ -358,6 +347,7 @@ export class DataApi {
                 requestJson: await serializeContext(),
                 findOptionsJson: findOptionsToJson(r.findOptions, this.repository.metadata),
                 lastIds: r.r.map((y) => this.repository.metadata.idMetadata.getId(y)),
+                version: 0,
             };
             await this.remult.liveQueryStorage.add({
                 entityKey: this.repository.metadata.key,
@@ -367,10 +357,7 @@ export class DataApi {
             response.success(r.r);
         }
         catch (err) {
-            if (err.isForbiddenError)
-                response.forbidden();
-            else
-                response.error(err, this.repository.metadata);
+            this.handleError(response, err);
         }
     }
     async buildWhere(request, body) {
@@ -395,6 +382,7 @@ export class DataApi {
                     return result;
                 },
             });
+            f = this.omitFieldsHiddenFromApi(f);
             if (this.repository.metadata.options.apiPreprocessFilter) {
                 f = await this.repository.metadata.options.apiPreprocessFilter(f, {
                     metadata: this.repository.metadata,
@@ -407,6 +395,30 @@ export class DataApi {
         }
         return { $and: where };
     }
+    // A hidden field is not on the api, same as a field that is not on the entity.
+    fieldIsInApi(key) {
+        return this.repository.fields.find(key)?.includedInApi() === true;
+    }
+    fieldsInApi(keys) {
+        return keys?.filter((key) => this.fieldIsInApi(key));
+    }
+    // Drop a field the api hides. Same as a field that is not on the entity:
+    // refusing it would confirm the name exists.
+    omitFieldsHiddenFromApi(filterOrSort) {
+        const fields = this.repository.metadata.fields;
+        return walkFilter(filterOrSort, function (key, value) {
+            if (!key.startsWith(customUrlToken) &&
+                fields.find(key)?.includedInApi() === false)
+                return omitFilterField;
+            return value;
+        });
+    }
+    handleError(response, err) {
+        if (err.isForbiddenError)
+            response.forbidden(err.message);
+        else
+            response.error(err, this.repository.metadata);
+    }
     async doOnId(response, id, what) {
         try {
             var where = [
@@ -466,7 +478,7 @@ export class DataApi {
             });
         }
         catch (err) {
-            response.error(err, this.repository.metadata);
+            this.handleError(response, err);
         }
     }
     async actualUpdate(row, body, req, doNotSelect) {
@@ -512,11 +524,22 @@ export class DataApi {
             return this.repository.getEntityRef(newr).toApiJson();
         };
         if (Array.isArray(body)) {
-            const result = [];
+            let result = [];
             await doTransaction(this.remult, async () => {
+                const items = [];
                 for (const item of body) {
-                    result.push(await insert(item));
+                    let newr = this.repository.create();
+                    await this.repository.getEntityRef(newr)._updateEntityBasedOnApi(item);
+                    if (!this.repository.getEntityRef(newr).apiInsertAllowed) {
+                        throw new ForbiddenError();
+                    }
+                    items.push(newr);
                 }
+                const inserted = await this.repository.insert(items, options);
+                if (options?.select === 'none')
+                    result = items.map(() => undefined);
+                else
+                    result = inserted.map((row) => this.repository.getEntityRef(row).toApiJson());
             });
             return result;
         }