spice-js 2.7.32 → 2.7.33

package/build/models/SpiceModel.js

@@ -32,7 +32,8 @@ var SDate = require("sonover-date"),
   _mapping_concurrency = Symbol(),
   _skip_mapped_serialization = Symbol(),
   _mapping_dept_exempt = Symbol(),
-  _current_path = Symbol();
+  _current_path = Symbol(),
+  _failed_json_fields = Symbol();
 var GLOBAL_MAPPING_CONCURRENCY = Math.max(1, Number(process.env.SPICE_MAPPING_GLOBAL_CONCURRENCY) || 32);
 var activeGlobalMappings = 0;
 var globalMappingWaiters = [];
@@ -71,7 +72,7 @@ function _acquireGlobalMappingSlot() {
 }
 function runWithConcurrency(_x, _x2, _x3) {
   return _runWithConcurrency.apply(this, arguments);
-} //const _type = Symbol("type");
+}
 function _runWithConcurrency() {
   _runWithConcurrency = _asyncToGenerator(function* (items, concurrency, worker) {
     var results = new Array(items.length);
@@ -97,6 +98,19 @@ function _runWithConcurrency() {
   });
   return _runWithConcurrency.apply(this, arguments);
 }
+var JSON_PARSE_FAILED = Symbol("json_parse_failed");
+function safeParseJsonField(value, fieldName, modelType) {
+  if (value == null || value === "") return undefined;
+  try {
+    return JSON.parse(value);
+  } catch (e) {
+    console.warn("SpiceModel(" + modelType + "): failed to parse field \"" + fieldName + "\" as JSON: " + e.message);
+    return JSON_PARSE_FAILED;
+  }
+}
+
+//const _type = Symbol("type");
+
 var that;
 if (!Promise.allSettled) {
   Promise.allSettled = promises => Promise.all(promises.map((promise, i) => promise.then(value => ({
@@ -135,6 +149,7 @@ class SpiceModel {
       this[_skip_cache] = ((_args4 = args) == null ? void 0 : (_args4$args = _args4.args) == null ? void 0 : _args4$args.skip_cache) || false;
       this[_level] = ((_args5 = args) == null ? void 0 : (_args5$args = _args5.args) == null ? void 0 : _args5$args._level) || 0;
       this[_current_path] = ((_args6 = args) == null ? void 0 : (_args6$args = _args6.args) == null ? void 0 : _args6$args._current_path) || "";
+      this[_failed_json_fields] = [];
       this[_columns] = ((_args7 = args) == null ? void 0 : (_args7$args = _args7.args) == null ? void 0 : _args7$args._columns) || "";
       this[_hooks] = {
         create: {
@@ -258,13 +273,33 @@ class SpiceModel {
               case Array:
               case "array":
                 {
-                  this[i] = _.isArray(args.args[i]) ? args.args[i] : JSON.parse(args.args[i]);
+                  if (_.isArray(args.args[i])) {
+                    this[i] = args.args[i];
+                  } else {
+                    var parsed = safeParseJsonField(args.args[i], i, args.collection || this.type);
+                    if (parsed === JSON_PARSE_FAILED) {
+                      this[_failed_json_fields].push(i);
+                      this[i] = [];
+                    } else if (parsed !== undefined) {
+                      this[i] = parsed;
+                    }
+                  }
                   break;
                 }
               case Object:
               case "object":
                 {
-                  this[i] = _.isObject(args.args[i]) ? args.args[i] : JSON.parse(args.args[i]);
+                  if (_.isObject(args.args[i])) {
+                    this[i] = args.args[i];
+                  } else {
+                    var _parsed = safeParseJsonField(args.args[i], i, args.collection || this.type);
+                    if (_parsed === JSON_PARSE_FAILED) {
+                      this[_failed_json_fields].push(i);
+                      this[i] = {};
+                    } else if (_parsed !== undefined) {
+                      this[i] = _parsed;
+                    }
+                  }
                   break;
                 }
               default:
@@ -848,6 +883,21 @@ class SpiceModel {
       }
     })();
   }
+  get failedJsonFields() {
+    return this[_failed_json_fields] || [];
+  }
+
+  // Refuse writes when a schema-typed object/array field contained invalid
+  // JSON, so a parse fallback can never overwrite valid stored data.
+  assertNoFailedJsonFields(operation) {
+    var failed = this[_failed_json_fields] || [];
+    if (failed.length > 0) {
+      var err = new Error(this.type + ": cannot " + operation + " because field(s) [" + failed.join(", ") + "] contained invalid JSON. Stored data was left untouched.");
+      err.status = 400;
+      err.failed_json_fields = [...failed];
+      throw err;
+    }
+  }
   update(args) {
     var _this8 = this;
     return _asyncToGenerator(function* () {
@@ -856,6 +906,7 @@ class SpiceModel {
       var p = (_this8$_ctx = _this8[_ctx]) == null ? void 0 : _this8$_ctx.profiler;
       var doUpdate = /*#__PURE__*/function () {
         var _ref1 = _asyncToGenerator(function* () {
+          _this8.assertNoFailedJsonFields("update");
           _this8.updated_at = new SDate().now();
           var results = yield _this8.database.get(args.id);
           var item_exist = yield _this8.exist(results);
@@ -926,6 +977,7 @@ class SpiceModel {
       var p = (_this9$_ctx = _this9[_ctx]) == null ? void 0 : _this9$_ctx.profiler;
       var doCreate = /*#__PURE__*/function () {
         var _ref11 = _asyncToGenerator(function* () {
+          _this9.assertNoFailedJsonFields("create");
           var form;
           _this9.created_at = new SDate().now();
           args = _.defaults(args, {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "spice-js",
-  "version": "2.7.32",
+  "version": "2.7.33",
   "description": "spice",
   "main": "build/index.js",
   "repository": {

package/src/models/SpiceModel.js

@@ -27,7 +27,8 @@ var SDate = require("sonover-date"),
   _mapping_concurrency = Symbol(),
   _skip_mapped_serialization = Symbol(),
   _mapping_dept_exempt = Symbol(),
-  _current_path = Symbol();
+  _current_path = Symbol(),
+  _failed_json_fields = Symbol();
 
 const GLOBAL_MAPPING_CONCURRENCY = Math.max(
   1,
@@ -82,6 +83,20 @@ async function runWithConcurrency(items, concurrency, worker) {
   return results;
 }
 
+const JSON_PARSE_FAILED = Symbol("json_parse_failed");
+
+function safeParseJsonField(value, fieldName, modelType) {
+  if (value == null || value === "") return undefined;
+  try {
+    return JSON.parse(value);
+  } catch (e) {
+    console.warn(
+      `SpiceModel(${modelType}): failed to parse field "${fieldName}" as JSON: ${e.message}`,
+    );
+    return JSON_PARSE_FAILED;
+  }
+}
+
 //const _type = Symbol("type");
 
 let that;
@@ -144,6 +159,7 @@ export default class SpiceModel {
       this[_skip_cache] = args?.args?.skip_cache || false;
       this[_level] = args?.args?._level || 0;
       this[_current_path] = args?.args?._current_path || "";
+      this[_failed_json_fields] = [];
       this[_columns] = args?.args?._columns || "";
       this[_hooks] = {
         create: {
@@ -289,18 +305,40 @@ export default class SpiceModel {
               }
               case Array:
               case "array": {
-                this[i] =
-                  _.isArray(args.args[i]) ?
-                    args.args[i]
-                  : JSON.parse(args.args[i]);
+                if (_.isArray(args.args[i])) {
+                  this[i] = args.args[i];
+                } else {
+                  const parsed = safeParseJsonField(
+                    args.args[i],
+                    i,
+                    args.collection || this.type,
+                  );
+                  if (parsed === JSON_PARSE_FAILED) {
+                    this[_failed_json_fields].push(i);
+                    this[i] = [];
+                  } else if (parsed !== undefined) {
+                    this[i] = parsed;
+                  }
+                }
                 break;
               }
               case Object:
               case "object": {
-                this[i] =
-                  _.isObject(args.args[i]) ?
-                    args.args[i]
-                  : JSON.parse(args.args[i]);
+                if (_.isObject(args.args[i])) {
+                  this[i] = args.args[i];
+                } else {
+                  const parsed = safeParseJsonField(
+                    args.args[i],
+                    i,
+                    args.collection || this.type,
+                  );
+                  if (parsed === JSON_PARSE_FAILED) {
+                    this[_failed_json_fields].push(i);
+                    this[i] = {};
+                  } else if (parsed !== undefined) {
+                    this[i] = parsed;
+                  }
+                }
                 break;
               }
               default: {
@@ -941,11 +979,32 @@ export default class SpiceModel {
     }
   }
 
+  get failedJsonFields() {
+    return this[_failed_json_fields] || [];
+  }
+
+  // Refuse writes when a schema-typed object/array field contained invalid
+  // JSON, so a parse fallback can never overwrite valid stored data.
+  assertNoFailedJsonFields(operation) {
+    const failed = this[_failed_json_fields] || [];
+    if (failed.length > 0) {
+      const err = new Error(
+        `${this.type}: cannot ${operation} because field(s) [${failed.join(
+          ", ",
+        )}] contained invalid JSON. Stored data was left untouched.`,
+      );
+      err.status = 400;
+      err.failed_json_fields = [...failed];
+      throw err;
+    }
+  }
+
   async update(args) {
     // Profiling: use track() for proper async context forking
     const p = this[_ctx]?.profiler;
 
     const doUpdate = async () => {
+      this.assertNoFailedJsonFields("update");
       this.updated_at = new SDate().now();
       let results = await this.database.get(args.id);
       let item_exist = await this.exist(results);
@@ -1025,6 +1084,7 @@ export default class SpiceModel {
     const p = this[_ctx]?.profiler;
 
     const doCreate = async () => {
+      this.assertNoFailedJsonFields("create");
       let form;
       this.created_at = new SDate().now();
       args = _.defaults(args, { id_prefix: this.type });

package/tests/__mocks__/spice-couchbase.js

@@ -44,6 +44,18 @@ class MockDatabase {
     return updated;
   }
 
+  /**
+   * Mock insert operation
+   * @param {string} id - Document ID
+   * @param {Object} data - Document data
+   * @returns {Promise<Object>} Inserted document
+   */
+  async insert(id, data, ttl) {
+    const inserted = { ...data, id };
+    this.mockData.set(id, inserted);
+    return inserted;
+  }
+
   /**
    * Seed mock database with test data
    * @param {string} id - Document ID

package/tests/models/SpiceModel.test.js

@@ -631,3 +631,255 @@ describe('SpiceModel - Critical Fixes for Empty/Null Values', () => {
     });
   });
 });
+
+describe('SpiceModel - Constructor JSON parse resilience', () => {
+  let warnSpy;
+
+  beforeEach(() => {
+    warnSpy = jest.spyOn(console, 'warn').mockImplementation(() => {});
+  });
+
+  afterEach(() => {
+    warnSpy.mockRestore();
+  });
+
+  test('should fall back to {} for HTML in object-typed field and finish init', () => {
+    const modifiersSpy = jest.spyOn(
+      SpiceModel.prototype,
+      'createModifiersFromProps'
+    );
+
+    const model = createTestModel({
+      type: 'application',
+      props: {
+        name: { type: String },
+        metadata: { type: Object },
+        title: { type: String },
+      },
+      args: {
+        name: 'App One',
+        metadata: '<p style="color:red">broken</p>',
+        title: 'Still set',
+      },
+    });
+
+    expect(model.metadata).toEqual({});
+    expect(model.name).toBe('App One');
+    expect(model.title).toBe('Still set');
+    expect(modifiersSpy).toHaveBeenCalled();
+    expect(warnSpy).toHaveBeenCalledWith(
+      expect.stringContaining('failed to parse field "metadata"')
+    );
+
+    modifiersSpy.mockRestore();
+  });
+
+  test('should fall back to [] for invalid JSON in array-typed field', () => {
+    const model = createTestModel({
+      type: 'addition',
+      props: {
+        name: { type: String },
+        tags: { type: Array },
+      },
+      args: {
+        name: 'Addition One',
+        tags: '<p style="">not json</p>',
+      },
+    });
+
+    expect(model.tags).toEqual([]);
+    expect(model.name).toBe('Addition One');
+    expect(warnSpy).toHaveBeenCalledWith(
+      expect.stringContaining('failed to parse field "tags"')
+    );
+  });
+
+  test('should parse valid JSON strings for object and array fields', () => {
+    const model = createTestModel({
+      type: 'application',
+      props: {
+        metadata: { type: Object },
+        tags: { type: Array },
+      },
+      args: {
+        metadata: '{"foo":"bar"}',
+        tags: '["a","b"]',
+      },
+    });
+
+    expect(model.metadata).toEqual({ foo: 'bar' });
+    expect(model.tags).toEqual(['a', 'b']);
+    expect(warnSpy).not.toHaveBeenCalledWith(
+      expect.stringContaining('failed to parse field')
+    );
+  });
+
+  test('should pass through already-parsed object and array values', () => {
+    const metadata = { foo: 'bar' };
+    const tags = ['a', 'b'];
+
+    const model = createTestModel({
+      type: 'application',
+      props: {
+        metadata: { type: Object },
+        tags: { type: Array },
+      },
+      args: {
+        metadata,
+        tags,
+      },
+    });
+
+    expect(model.metadata).toBe(metadata);
+    expect(model.tags).toBe(tags);
+  });
+
+  test('should track failed fields on the model', () => {
+    const model = createTestModel({
+      type: 'application',
+      props: {
+        metadata: { type: Object },
+        tags: { type: Array },
+      },
+      args: {
+        metadata: '<p>bad</p>',
+        tags: 'also bad',
+      },
+    });
+
+    expect(model.failedJsonFields.sort()).toEqual(['metadata', 'tags']);
+  });
+
+  test('should have no failed fields when all values parse', () => {
+    const model = createTestModel({
+      type: 'application',
+      props: {
+        metadata: { type: Object },
+      },
+      args: {
+        metadata: '{"foo":"bar"}',
+      },
+    });
+
+    expect(model.failedJsonFields).toEqual([]);
+  });
+});
+
+describe('SpiceModel - Write protection for failed JSON fields', () => {
+  let warnSpy;
+
+  beforeEach(() => {
+    warnSpy = jest.spyOn(console, 'warn').mockImplementation(() => {});
+  });
+
+  afterEach(() => {
+    warnSpy.mockRestore();
+  });
+
+  test('update should reject and preserve stored data when a field failed to parse', async () => {
+    const model = createTestModel({
+      type: 'application',
+      props: {
+        name: { type: String },
+        metadata: { type: Object },
+      },
+      args: {
+        name: 'Updated Name',
+        metadata: '<p style="color:red">broken html</p>',
+        skip_serialize: true,
+        skip_hooks: true,
+      },
+    });
+
+    const storedDoc = {
+      id: 'application-1',
+      name: 'Original Name',
+      metadata: { important: 'data' },
+    };
+    seedDatabase(model, storedDoc);
+    jest.spyOn(model.database, 'update');
+
+    await expect(
+      model.update({ id: 'application-1', skip_serialize: true, skip_hooks: true })
+    ).rejects.toThrow(/cannot update.*metadata.*invalid JSON/);
+
+    // No write must reach the database; stored data stays intact
+    expect(model.database.update).not.toHaveBeenCalled();
+    const stored = await model.database.get('application-1');
+    expect(stored.metadata).toEqual({ important: 'data' });
+  });
+
+  test('update rejection should carry status 400 and the failed field names', async () => {
+    const model = createTestModel({
+      type: 'application',
+      props: {
+        metadata: { type: Object },
+      },
+      args: {
+        metadata: 'not json at all',
+        skip_serialize: true,
+        skip_hooks: true,
+      },
+    });
+    seedDatabase(model, { id: 'application-1', metadata: { keep: true } });
+
+    let caught;
+    try {
+      await model.update({ id: 'application-1', skip_serialize: true, skip_hooks: true });
+    } catch (e) {
+      caught = e;
+    }
+
+    expect(caught).toBeDefined();
+    expect(caught.status).toBe(400);
+    expect(caught.failed_json_fields).toEqual(['metadata']);
+  });
+
+  test('create should reject when a field failed to parse', async () => {
+    const model = createTestModel({
+      type: 'application',
+      props: {
+        metadata: { type: Object },
+      },
+      args: {
+        metadata: '<div>nope</div>',
+        skip_serialize: true,
+        skip_hooks: true,
+      },
+    });
+    jest.spyOn(model.database, 'insert');
+
+    await expect(
+      model.create({ skip_serialize: true, skip_hooks: true })
+    ).rejects.toThrow(/cannot create.*metadata.*invalid JSON/);
+    expect(model.database.insert).not.toHaveBeenCalled();
+  });
+
+  test('update should proceed normally when all fields parsed', async () => {
+    const model = createTestModel({
+      type: 'application',
+      props: {
+        name: { type: String },
+        metadata: { type: Object },
+      },
+      args: {
+        name: 'New Name',
+        metadata: '{"valid":"json"}',
+        skip_serialize: true,
+        skip_hooks: true,
+      },
+    });
+    seedDatabase(model, { id: 'application-1', name: 'Old', metadata: {} });
+    // setMonitor needs the real cache global, which test mocks don't provide
+    jest.spyOn(model, 'setMonitor').mockImplementation(() => {});
+
+    const result = await model.update({
+      id: 'application-1',
+      skip_serialize: true,
+      skip_hooks: true,
+    });
+
+    expect(result.name).toBe('New Name');
+    expect(result.metadata).toEqual({ valid: 'json' });
+  });
+});