velocious 1.0.643 → 1.0.645

package/src/frontend-model-controller.js

@@ -21,6 +21,7 @@ import { normalizeDateStringForWrite } from "./database/datetime-storage.js"
 import VelociousError from "./velocious-error.js"
 import isDate from "./utils/is-date.js"
 import isPlainObject from "./utils/plain-object.js"
+import {compositeModelPrimaryKeyCohortSql, modelPrimaryKeyCacheKey, modelPrimaryKeyConditions, modelPrimaryKeyValueFromCacheKey, readModelPrimaryKeyValue, scalarModelPrimaryKey} from "./utils/model-primary-key.js"
 import {RansackQueryError, normalizeRansackGroup, parseRansackSort} from "./utils/ransack.js"
 
 /**
@@ -80,6 +81,8 @@ import {RansackQueryError, normalizeRansackGroup, parseRansackSort} from "./util
  * @returns {void}
  */
 
+const ATTACHMENT_OWNER_KEY = "__attachmentOwner"
+
 /**
  * Runs normalize frontend model preload.
  * @param {import("./database/query/index.js").NestedPreloadRecord | string | string[] | boolean | undefined | null} preload - Preload shorthand.
@@ -821,6 +824,10 @@ export default class FrontendModelController extends Controller {
 
     if (!frontendModelResource) return null
 
+    if (this.frontendModelResourceModelClass(frontendModelResource) === modelClass) {
+      return frontendModelResource
+    }
+
     return this.frontendModelResourceConfigurationForBackendProjectModelName({
       backendProject: frontendModelResource.backendProject,
       modelName: modelClass.getModelName()
@@ -1047,10 +1054,10 @@ export default class FrontendModelController extends Controller {
 
   /**
    * Runs frontend model primary key.
-   * @returns {string} - Frontend model primary key.
+   * @returns {import("./utils/model-primary-key.js").ModelPrimaryKeyDefinition} - Frontend model primary key.
    */
   frontendModelPrimaryKey() {
-    return this.frontendModelClass().primaryKey()
+    return this.frontendModelResourceInstance().primaryKey()
   }
 
   /**
@@ -1086,41 +1093,95 @@ export default class FrontendModelController extends Controller {
   /**
    * Runs frontend model ability authorized query.
    * @param {"index" | "find" | "create" | "update" | "destroy" | "attach" | "attachmentList" | "download" | "url"} action - Frontend action.
+   * @param {{ruleQueryFactory?: () => import("./database/query/model-class-query.js").default<typeof import("./database/record/index.js").default>}} [options] - Authorization query options.
    * @returns {import("./database/query/model-class-query.js").default<typeof import("./database/record/index.js").default>} - Authorized query for the action.
    */
-  frontendModelAbilityAuthorizedQuery(action) {
+  frontendModelAbilityAuthorizedQuery(action, {ruleQueryFactory} = {}) {
     const abilityAction = this.frontendModelAbilityAction(action)
+    const modelClass = this.frontendModelClass()
+
+    if (!ruleQueryFactory) return modelClass.accessibleFor(abilityAction, this.currentAbility())
+
+    const ability = this.currentAbility()
 
-    return this.frontendModelClass().accessibleFor(abilityAction, this.currentAbility())
+    if (!ability) {
+      throw new Error(`No ability in context for ${modelClass.name}. Configure an ability resolver on the request`)
+    }
+
+    return ability.applyToQuery({
+      action: abilityAction,
+      modelClass,
+      query: modelClass._newQuery(),
+      ruleQueryFactory
+    })
   }
 
   /**
    * Runs frontend model authorized query.
    * @param {"index" | "find" | "create" | "update" | "destroy" | "attach" | "attachmentList" | "download" | "url"} action - Frontend action.
+   * @param {{ruleQueryFactory?: () => import("./database/query/model-class-query.js").default<typeof import("./database/record/index.js").default>}} [options] - Authorization query options.
    * @returns {import("./database/query/model-class-query.js").default<typeof import("./database/record/index.js").default>} - Authorized query for the action.
    */
-  frontendModelAuthorizedQuery(action) {
+  frontendModelAuthorizedQuery(action, options = {}) {
     const resource = this.frontendModelResourceInstance()
 
     if (resource.authorizedQuery !== FrontendModelBaseResource.prototype.authorizedQuery) {
-      return resource.authorizedQuery(action)
+      return resource.authorizedQuery(action, options)
     }
 
-    return this.frontendModelAbilityAuthorizedQuery(action)
+    return this.frontendModelAbilityAuthorizedQuery(action, options)
   }
 
   /**
    * Runs frontend model primary key value.
    * @param {import("./database/record/index.js").default} model - Model instance.
-   * @returns {string} - Primary key value as string.
+   * @returns {import("./utils/model-primary-key.js").ModelPrimaryKeyValue} - Primary key value.
    */
   frontendModelPrimaryKeyValue(model) {
-    const columnName = this.frontendModelPrimaryKey()
-    const attributeNameMap = model.getModelClass().getColumnNameToAttributeNameMap()
-    const attributeName = attributeNameMap[columnName] || columnName
-    const value = model.readAttribute(attributeName)
+    const primaryKey = this.frontendModelPrimaryKey()
+
+    return readModelPrimaryKeyValue(primaryKey, (attributeName) => model.readAttribute(attributeName))
+  }
 
-    return String(value)
+  /**
+   * Returns the authorized identities from a candidate cohort without per-record queries.
+   * @param {object} args - Arguments.
+   * @param {import("./utils/model-primary-key.js").ModelPrimaryKeyValue[]} args.identities - Candidate identities.
+   * @param {typeof import("./database/record/index.js").default} args.modelClass - Model class owning the identity attributes.
+   * @param {import("./utils/model-primary-key.js").ModelPrimaryKeyDefinition} args.primaryKey - Identity definition.
+   * @param {import("./database/query/model-class-query.js").default<typeof import("./database/record/index.js").default>} args.query - Authorized query.
+   * @returns {Promise<Set<string>>} - Canonical authorized identity keys.
+   */
+  async frontendModelAuthorizedIdentitySet({identities, modelClass, primaryKey, query}) {
+    if (!Array.isArray(primaryKey)) {
+      const authorizedIds = await query
+        .where({[primaryKey]: identities})
+        .pluck(primaryKey)
+
+      return new Set(authorizedIds.map((value) => modelPrimaryKeyCacheKey(primaryKey, value)))
+    }
+
+    const maxCompositeCohortSize = Math.max(1, Math.floor(query.driver.maxInClauseValues() / primaryKey.length))
+    const cohorts = query.driver.chunkValues(identities, (cohort) => query
+      .clone()
+      .where(compositeModelPrimaryKeyCohortSql({modelClass, primaryKey, query, values: cohort}))
+      .toSql(), {maxCount: maxCompositeCohortSize})
+    const authorizedIdentityKeys = new Set()
+
+    for (const cohort of cohorts) {
+      const authorizedModels = await query
+        .clone()
+        .where(compositeModelPrimaryKeyCohortSql({modelClass, primaryKey, query, values: cohort}))
+        .toArray()
+
+      for (const model of authorizedModels) {
+        const identity = readModelPrimaryKeyValue(primaryKey, (attributeName) => model.readAttribute(attributeName))
+
+        authorizedIdentityKeys.add(modelPrimaryKeyCacheKey(primaryKey, identity))
+      }
+    }
+
+    return authorizedIdentityKeys
   }
 
   /**
@@ -1134,14 +1195,16 @@ export default class FrontendModelController extends Controller {
     if (models.length === 0) return models
 
     const primaryKey = this.frontendModelPrimaryKey()
-    const ids = models.map((model) => this.frontendModelPrimaryKeyValue(model))
-    const authorizedQuery = this.frontendModelAuthorizedQuery(action).where({[primaryKey]: ids})
-
-    const authorizedIdsRaw = await authorizedQuery.pluck(primaryKey)
 
-    const authorizedIds = new Set(authorizedIdsRaw.map((id) => String(id)))
+    const identities = models.map((model) => this.frontendModelPrimaryKeyValue(model))
+    const authorizedIds = await this.frontendModelAuthorizedIdentitySet({
+      identities,
+      modelClass: this.frontendModelClass(),
+      primaryKey,
+      query: this.frontendModelAuthorizedQuery(action)
+    })
 
-    return models.filter((model) => authorizedIds.has(this.frontendModelPrimaryKeyValue(model)))
+    return models.filter((model) => authorizedIds.has(modelPrimaryKeyCacheKey(primaryKey, this.frontendModelPrimaryKeyValue(model))))
   }
 
   /**
@@ -1158,7 +1221,7 @@ export default class FrontendModelController extends Controller {
   /**
    * Runs frontend model find record.
    * @param {"find" | "update" | "destroy" | "attach" | "attachmentList" | "download" | "url"} action - Frontend action.
-   * @param {string | number} id - Record id.
+   * @param {import("./utils/model-primary-key.js").ModelPrimaryKeyValue} id - Record id.
    * @returns {Promise<import("./database/record/index.js").default | null>} - Located model record.
    */
   async frontendModelFindRecord(action, id) {
@@ -1471,17 +1534,21 @@ export default class FrontendModelController extends Controller {
       if (candidates.length === 0) continue
 
       const primaryKey = modelClass.primaryKey()
-      const ids = candidates
-        .map((record) => record.readAttribute(primaryKey))
-        .filter((value) => value !== null && value !== undefined)
-      if (ids.length === 0) continue
 
       for (const action of entry.actions) {
+        /** @type {Set<string>} */
         let allowedIds
         try {
-          const authorizedQuery = modelClass.accessibleFor(action, ability).where({[primaryKey]: ids})
-          const plucked = await authorizedQuery.pluck(primaryKey)
-          allowedIds = new Set(plucked.map((value) => String(value)))
+          const authorizedQuery = modelClass.accessibleFor(action, ability)
+
+          const identities = candidates.map((record) => record.id())
+
+          allowedIds = await this.frontendModelAuthorizedIdentitySet({
+            identities,
+            modelClass,
+            primaryKey,
+            query: authorizedQuery
+          })
         } catch (error) {
           // An ability with no allow rules for the action throws via
           // `accessibleFor`; treat as a universal deny so the frontend
@@ -1492,8 +1559,8 @@ export default class FrontendModelController extends Controller {
         }
 
         for (const record of candidates) {
-          const idValue = record.readAttribute(primaryKey)
-          const allowed = idValue !== null && idValue !== undefined && allowedIds.has(String(idValue))
+          const idValue = record.id()
+          const allowed = allowedIds.has(modelPrimaryKeyCacheKey(primaryKey, idValue))
           record._setComputedAbility(action, allowed)
         }
       }
@@ -1659,7 +1726,7 @@ export default class FrontendModelController extends Controller {
    */
   frontendModelMssqlDistinctByPrimaryKeyQuery({query}) {
     const modelClass = this.frontendModelClass()
-    const primaryKey = modelClass.primaryKey()
+    const primaryKey = scalarModelPrimaryKey(modelClass.primaryKey(), "MSSQL distinct frontend-model queries")
     const rootTableSql = query.driver.quoteTable(modelClass.tableName())
     const primaryKeySql = `${rootTableSql}.${query.driver.quoteColumn(primaryKey)}`
     const distinctIdsQuery = query.clone()
@@ -2972,7 +3039,7 @@ export default class FrontendModelController extends Controller {
     const authorizedIdsByClass = new Map()
     /**
      * Primary keys by class.
-     * @type {Map<typeof import("./database/record/index.js").default, string>} */
+     * @type {Map<typeof import("./database/record/index.js").default, import("./utils/model-primary-key.js").ModelPrimaryKeyDefinition>} */
     const primaryKeysByClass = new Map()
 
     for (const [relatedModelClass, relatedModels] of modelsByClass.entries()) {
@@ -2993,22 +3060,16 @@ export default class FrontendModelController extends Controller {
       }
 
       const primaryKey = relatedModelClass.primaryKey()
-      const ids = relatedModels
-        .map((model) => model.attributes()[primaryKey])
-        .filter((id) => id !== undefined && id !== null)
-
-      if (ids.length < 1) {
-        authorizedIdsByClass.set(relatedModelClass, new Set())
-        continue
-      }
-
-      const authorizedIdsRaw = await relatedModelClass
-        .accessibleFor(abilityAction)
-        .where({[primaryKey]: ids})
-        .pluck(primaryKey)
+      const identities = relatedModels.map((model) => model.id())
+      const authorizedIds = await this.frontendModelAuthorizedIdentitySet({
+        identities,
+        modelClass: relatedModelClass,
+        primaryKey,
+        query: relatedModelClass.accessibleFor(abilityAction)
+      })
 
       primaryKeysByClass.set(relatedModelClass, primaryKey)
-      authorizedIdsByClass.set(relatedModelClass, new Set(authorizedIdsRaw.map((id) => String(id))))
+      authorizedIdsByClass.set(relatedModelClass, authorizedIds)
     }
 
     return models.filter((model) => {
@@ -3018,11 +3079,7 @@ export default class FrontendModelController extends Controller {
 
       if (!authorizedIds || !primaryKey) return false
 
-      const primaryKeyValue = model.attributes()[primaryKey]
-
-      if (primaryKeyValue === undefined || primaryKeyValue === null) return false
-
-      return authorizedIds.has(String(primaryKeyValue))
+      return authorizedIds.has(modelPrimaryKeyCacheKey(primaryKey, model.id()))
     })
   }
 
@@ -3141,8 +3198,10 @@ export default class FrontendModelController extends Controller {
       const hasQueryData = Object.keys(queryDataValues).length > 0
       const hasAbilities = Object.keys(computedAbilities).length > 0
       const hasPreloaded = Object.keys(preloadedRelationships).length > 0
+      const resource = this._serializationResourceInstanceForModel(model)
+      const hasAttachmentOwner = Object.keys(resource?.resourceConfiguration().attachments || {}).length > 0
 
-      if (!hasPreloaded && !hasCounts && !hasQueryData && !hasAbilities) {
+      if (!hasPreloaded && !hasCounts && !hasQueryData && !hasAbilities && !hasAttachmentOwner) {
         serializedModels.push(serializedAttributes)
         continue
       }
@@ -3156,6 +3215,17 @@ export default class FrontendModelController extends Controller {
       if (hasCounts) serialized.__associationCounts = associationCounts
       if (hasQueryData) serialized.__queryData = queryDataValues
       if (hasAbilities) serialized.__abilities = computedAbilities
+      if (hasAttachmentOwner) {
+        if (!resource) throw new Error(`Missing frontend model resource for attachment owner ${model.getModelClass().getModelName()}`)
+
+        const modelClass = model.getModelClass()
+
+        serialized[ATTACHMENT_OWNER_KEY] = {
+          recordId: modelPrimaryKeyCacheKey(modelClass.primaryKey(), model.id()),
+          recordType: modelClass.getModelName(),
+          resourceName: resource.modelName()
+        }
+      }
 
       serializedModels.push(serialized)
     }
@@ -3465,7 +3535,8 @@ export default class FrontendModelController extends Controller {
 
     const params = this.frontendModelParams()
     const modelClass = this.frontendModelClass()
-    const id = params.id
+    const primaryKey = this.frontendModelPrimaryKey()
+    let id = params.id
 
     if (action === "create") {
       const mutationAttributes = frontendModelMutationAttributes(params)
@@ -3486,10 +3557,22 @@ export default class FrontendModelController extends Controller {
       return frontendModelSerializedModelSuccess(serializedModel)
     }
 
-    if ((typeof id !== "string" && typeof id !== "number") || `${id}`.length < 1) {
+    if (!Array.isArray(primaryKey) && ((typeof id !== "string" && typeof id !== "number") || `${id}`.length < 1)) {
       return this.frontendModelErrorPayload("Expected model id.", {errorType: "validation_error"})
     }
 
+    try {
+      if (Array.isArray(primaryKey) && typeof id === "string") {
+        id = modelPrimaryKeyValueFromCacheKey(primaryKey, id)
+      }
+
+      modelPrimaryKeyConditions(primaryKey, id)
+    } catch (error) {
+      if (!(error instanceof TypeError)) throw error
+
+      return this.frontendModelErrorPayload(error.message, {errorType: "validation_error"})
+    }
+
     if (action === "attach") {
       const attachmentName = params.attachmentName
       const attachmentInput = params.attachment