393 Commits

Author	SHA1	Message	Date
Hein	873e8925d4	fix(handler): ensure target ID is provided for updates	2026-07-24 16:35:22 +02:00
Hein	b23916048a	fix: ordering in before hook	2026-07-24 15:56:23 +02:00
Hein	47708fc87a	fix(security): run RLS-scoping hooks in the same transaction as their queries ... BeforeRead/BeforeCreate hooks (used to set session-scoped RLS GUCs) were firing against the pooled db handle while the actual queries ran as separate calls to the same pool. Under connection pooling these could land on different physical connections, silently bypassing row-level security on creates and reads. handleUpdate already did this correctly; handleRead/handleCreate in both resolvespec and restheadspec now wrap hook execution and queries in a single RunInTransaction call.	2026-07-24 12:40:27 +02:00
Hein	a85e572732	fix(hooks): reset Tx to pooled connection for post-commit hook calls ... BeforeScan (restheadspec handleUpdate) and BeforeResponse (funcspec list/single query handlers) fire after RunInTransaction commits, but hookCtx.Tx still pointed at the now-dead transaction. Any hook that executed a query against Tx (e.g. setUserViaContext) failed with "sql: transaction has already been committed or rolled back".	2026-07-20 13:45:13 +02:00
Hein	598fd687f6	feat(security): add GetUserRef method for opaque user identifiers	2026-07-10 13:47:32 +02:00
Hein	eee83f9dc6	feat(security): add query mode handling for database operations ... * Introduced QueryMode to select between stored procedure and direct SQL execution. * Implemented dbCapability to probe for stored procedure existence. * Added table names configuration for direct SQL operations. * Updated DatabaseTwoFactorProvider to support query mode and table names. * Implemented direct SQL methods mirroring stored procedures for TOTP operations. * Added tests for query mode logic and table names validation.	2026-07-07 15:29:29 +02:00
Hein	8a06aacfb2	fix(cors): update CORS headers handling for requests ... * Reflect request origin for Access-Control-Allow-Origin * Set Vary header for caching based on origin * Allow specific headers from preflight requests * Enable credentials only for specific origins	2026-07-01 12:27:39 +02:00
Hein	705c4f8001	fix(manager): ensure HTTP1 is set when HTTP2 is disabled	2026-06-30 13:54:56 +02:00
Hein	d648614611	feat(config): add PanicHandler to Config for custom recovery	2026-06-30 13:49:51 +02:00
Hein	3f86eb0f06	feat(config): add HTTP2 field to ServerInstanceConfig and align with server.Config	2026-06-30 13:36:06 +02:00
Hein	3dac55cb19	fix: Set http2 based on prop	2026-06-30 13:29:55 +02:00
Hein	bbb2c6d127	feat(server): add HTTP2 support in server configuration	2026-06-30 11:33:31 +02:00
Hein	3fec7b1a90	fix(handler): update Content-Range headers for API response ... * change Content-Range format to include 'items' * add X-Api-Range-From and X-Api-Modelname headers * add X-Api-Range-Etotal header for total filtered items	2026-06-24 10:02:54 +02:00
Hein	910390f62d	fix(headers): correct order of limit and offset parsing	2026-06-24 09:47:14 +02:00
Hein	b9bed67bd7	feat(security): add program user ID and table to user context	2026-06-23 10:18:22 +02:00
Hein	11ef16f75a	fix(sql_helpers): adjust parenthesis nesting depth comment	2026-06-23 09:41:40 +02:00
Hein	48b72a7631	fix(sql_helpers): enhance splitByAND to handle BETWEEN and quotes ... * Add support for BETWEEN-aware AND detection * Ensure AND inside single-quoted strings does not cause splits * Update tests to cover new BETWEEN and quote scenarios	2026-06-23 09:41:27 +02:00
Hein	4c512acf25	test(function_api): add test for x-detailapi header response	2026-06-23 08:53:33 +02:00
Hein	07a402634e	fix(function_api): enhance detail format with table metadata ... * include table name and prefix in response * add field metadata extraction for raw SQL results	2026-06-23 08:50:29 +02:00
Hein	0e8f8925c6	fix(reflection): replace reflect.Ptr with reflect.Pointer ... * Updated all instances of reflect.Ptr to reflect.Pointer for consistency in type checking.	2026-06-22 16:40:07 +02:00
Hein	5a359a160b	fix(handler): update sendFormattedResponse to include table name and model	2026-06-22 16:38:21 +02:00
Hein	a2799fa224	fix(handler): re-fetch records to capture DB-generated values	2026-06-12 16:28:51 +02:00
Hein	1419542650	fix(handler): re-fetch records to capture DB-generated changes	2026-06-12 13:37:07 +02:00
Hein	c120b49529	fix(router): prevent HTML escaping in JSON responses ... fix(sql_helpers): avoid prefix extraction in subqueries	2026-06-08 15:13:58 +02:00
Hein	66348dac97	test(handler): add tests for valid nested request verbs	2026-06-08 09:06:29 +02:00
Hein	a87cd18b1b	fix(handler): validate nested request structure for relations ... * added checks for valid _request values in single and multiple relations * introduced isValidNestedRequest function to encapsulate validation logic fix(crud): expand operation handling for nested CUD * added "add" to insert operations and "modify" to update operations * included "remove" in delete operations	2026-06-08 09:02:29 +02:00
Hein	29449c93d5	fix(test): add tests for asymmetric join column handling	2026-06-07 19:13:59 +02:00
Hein	3b6e5c75be	fix(handler): update foreign key field resolution logic ... * Adjust foreign key field name selection for has-many/has-one relationships * Improve logging to clarify foreign key and child field usage	2026-06-07 14:20:55 +02:00
Hein	549ccb8468	fix(handler): fetch updated records after transaction commits ... * Update selection queries to use model columns * Ensure updated records are fetched and returned in responses	2026-06-05 11:12:04 +02:00
Hein	1af9c76337	fix(handler): fetch updated record after transaction commits	2026-06-04 18:23:18 +02:00
Hein	938a2ef3d9	fix(staticweb): add fallback for extensionless file paths	2026-05-27 18:41:43 +02:00
Hein	69cc3e2839	fix(db): update Returning method to accept multiple columns	2026-05-27 14:11:20 +02:00
Hein	4018af0636	fix(validation): enhance filter logic for column validation ... * adjust handling of "all" filter to consider filtered columns fix(function_api): improve variable substitution in SQL queries * add safeSubstituteVar for context-aware value sanitization	2026-05-27 12:17:31 +02:00
Hein	c4e79d6950	fix(validation): use strings.EqualFold for case-insensitive comparison	2026-05-27 12:07:08 +02:00
Hein	982a0e62ac	fix(validation): add Columns method to retrieve valid column names	2026-05-27 12:06:46 +02:00
Hein	5d459c95a7	fix(headers): reorder import statements for clarity	2026-05-27 11:28:39 +02:00
Hein	e9f7726e43	fix(headers): sort combined parameters before processing	2026-05-27 11:28:22 +02:00
Hein	3d2251317a	fix(headers): remove unused utf8 validation in DecodeParam	2026-05-26 10:31:34 +02:00
Hein	1ce0ab1ab4	fix(validation): improve preload column validation logic	2026-05-21 20:18:01 +02:00
Hein	1f9b230f7f	fix(validation): improve preload column validation logic ... * Use related model's validator for filtering preload columns * Ensure valid columns are checked against the correct validator	2026-05-21 20:16:53 +02:00
Hein	c42c6b28e3	fix(errortracking): update error context handling in Sentry ... * Replace event.Extra with event.Contexts["extra"] for error and message captures. * Consolidate extra context handling in CapturePanic method.	2026-05-21 14:03:01 +02:00
Hein	57e7503389	feat(staticweb): enhance fallback logic for extensionless paths ... * Added support for serving index.html for extensionless paths * Updated isStaticAsset to exclude paths without extensions from static asset checks	2026-05-21 13:30:39 +02:00
Hein	0308644075	feat(auth): add authenticate callback for fallback logic ... * Implement SetAuthenticateCallback in authenticators * Update Authenticate methods to use callback on failure	2026-05-21 11:27:51 +02:00
Hein	e5984f5205	feat(security): add cookie support for login and logout methods ... * Implement LoginWithCookie and LogoutWithCookie in stubAuthenticator, mockAuth, mockSecurityProvider, and MockAuthenticator * Update tests to use cookie-based authentication	2026-05-21 09:51:30 +02:00
Hein	76909ae869	feat(security): add cookie support for login and logout methods ... * Implement LoginWithCookie and LogoutWithCookie in CompositeSecurityProvider * Update Authenticator interface to include cookie methods * Add cookie support in HeaderAuthenticator and JWTAuthenticator	2026-05-21 09:48:46 +02:00
Hein	c90c2984ac	feat(security): add cookie session support to DatabaseAuthenticator ... * Introduce enableCookieSession option for session management * Implement LoginWithCookie and LogoutWithCookie methods * Update Authenticate method to support session token from cookie	2026-05-21 09:14:50 +02:00
Hein	1ab4ae33e7	feat(security): implement ChainAuthenticator for sequential authentication	2026-05-21 08:35:39 +02:00
Hein	905457964c	fix(restheadspec): remove redundant column selection in query	2026-05-21 08:34:09 +02:00
Hein	c42d09238f	fix: better error detail for failed sql	2026-05-20 13:06:26 +02:00
Hein	0647a88aba	fix(restheadspec): qualify primary key and sort columns with table alias	2026-05-20 12:41:16 +02:00