fix(api): stabilize report pagination + declare real { data, meta } envelope on v1 single/write endpoints (#811)
* fix(reports): stabilize fetchAllRows paging to stop doubled/dropped balances (#790, #791) PostgREST `.range()` paging is only correct when the underlying query has a stable TOTAL order. Several aggregating report queries (general ledger, trial balance, grundbok, supplier/AR ledgers, etc.) paginated without `.order()`, so on datasets larger than one 1000-row page Postgres could return rows in a different order between requests — silently DUPLICATING or SKIPPING rows on a page boundary and doubling or dropping financial totals. - fetch-all.ts: document the ordering invariant and add an optional `dedupeBy` defense-in-depth that drops cross-page duplicates and warns when it fires (surfaces a missing `.order()` in logs instead of corrupting money). - Add a stable `.order()` (line PK or account_number) to every paginated query in lib/reports/ and the account-balances route; pass `dedupeBy` on the money-aggregating line queries. - Add fetch-all unit tests and update report test fixtures to carry row ids. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * fix(api): declare the real { data, meta } envelope on v1 single/write/204 endpoints (#794) The OpenAPI generator derives each endpoint's documented body purely from its registered `response.success` Zod schema, and that schema is never validated at runtime — so a route could advertise a shape its handler never sends. #802 fixed this for list endpoints; the same drift was latent on single-resource and write endpoints, which declared the bare resource schema instead of the `{ data, meta }` envelope the handlers actually return. - registry.ts: extend `ResponseMetaSchema` with the optional `audit` block and `partial_expansions` list that writes/expansions emit; add the `NoBodyResponse` sentinel so 204 DELETE handlers document a bare 204 instead of a phantom 200. - Wrap every single/write endpoint's `response.success` in `dataEnvelope(...)` (or `NoBodyResponse` for 204s) across the v1 routes. - Add a response-envelope contract test that fails CI if any JSON endpoint forgets to wrap its schema, with binary downloads and 204s as the only exemptions. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * fix(reports): extend paging dedupeBy to rc-basis-gaps and opening-balances Address PR review: these two money-aggregating line queries already had the stable `.order('id')` (so paging was correct) but didn't carry `id` in the select, so they couldn't use the `dedupeBy` defense-in-depth that general-ledger and trial-balance got. Select `id` and pass `dedupeBy: r => r.id` so the whole report layer applies the ordering invariant consistently. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This commit is contained in:
Jakob Wennberg
@@ -0,0 +1,131 @@
|
||||
/**
|
||||
* Response-envelope contract test.
|
||||
*
|
||||
* Every v1 handler returns the canonical `{ data, meta }` envelope — `ok()` and
|
||||
* `created()` wrap a single object, `paginated()` wraps an array, both stamping
|
||||
* the shared `meta` block (see `lib/api/v1/response.ts`). The OpenAPI generator,
|
||||
* however, derives each endpoint's documented body purely from its registered
|
||||
* `response.success` Zod schema, and that schema is NOT validated at runtime —
|
||||
* so nothing stops a route from declaring a shape the handler never sends.
|
||||
*
|
||||
* That is exactly what issue #794 found: every list endpoint declared a bare
|
||||
* `{ <name>: [...] }` object that no handler emits. #802 fixed the list
|
||||
* endpoints (via `listEnvelope`/`dataEnvelope`); the same drift was latent on
|
||||
* the single-resource and write endpoints, which declared the bare resource
|
||||
* schema instead of `{ data, meta }`.
|
||||
*
|
||||
* This test is the regression guard the issue asked for. It asserts EVERY
|
||||
* JSON-returning endpoint declares the `{ data, meta }` envelope with the shared
|
||||
* `ResponseMetaSchema` — so a new endpoint that forgets to wrap its schema
|
||||
* (list OR single) fails CI here instead of shipping a lying spec. Binary
|
||||
* downloads (`response.contentType`) and 204 No Content endpoints
|
||||
* (`NoBodyResponse`) carry no JSON body and are the only exemptions.
|
||||
*/
|
||||
|
||||
import { describe, expect, it } from 'vitest'
|
||||
import { z } from 'zod'
|
||||
import { listEndpoints, ResponseMetaSchema, NoBodyResponse, listEnvelope, dataEnvelope } from '../registry'
|
||||
// Side-effect import — every route file's registerEndpoint() runs at module
|
||||
// load time and populates the shared ENDPOINTS map.
|
||||
import '../load-routes'
|
||||
|
||||
/** Binary downloads (PDF, SIE text) declare a non-JSON contentType. */
|
||||
function isBinary(success: { contentType?: string }): boolean {
|
||||
return !!success.contentType && success.contentType !== 'application/json'
|
||||
}
|
||||
|
||||
describe('v1 response envelope contract', () => {
|
||||
const endpoints = listEndpoints()
|
||||
|
||||
it('every JSON endpoint declares the { data, meta } envelope with the shared meta schema', () => {
|
||||
// Accumulate every violation so a failing run names ALL offending endpoints
|
||||
// at once (a fresh route that forgets to wrap, plus any that drift later),
|
||||
// instead of failing one-at-a-time across many edit cycles.
|
||||
const violations: string[] = []
|
||||
|
||||
for (const ep of endpoints) {
|
||||
const ctx = `${ep.method} ${ep.path} (${ep.operation})`
|
||||
|
||||
// Exemptions: binary bodies and 204-no-content have no JSON envelope.
|
||||
if (isBinary(ep.response)) continue
|
||||
if (ep.response.success === NoBodyResponse) continue
|
||||
|
||||
const success = ep.response.success
|
||||
if (!(success instanceof z.ZodObject)) {
|
||||
violations.push(`${ctx}: response.success is not a { data, meta } object — wrap it with listEnvelope()/dataEnvelope() (or use NoBodyResponse for 204 / response.contentType for binary).`)
|
||||
continue
|
||||
}
|
||||
|
||||
const shape = (success as z.ZodObject<z.ZodRawShape>).shape
|
||||
const keys = Object.keys(shape).sort()
|
||||
if (keys.length !== 2 || keys[0] !== 'data' || keys[1] !== 'meta') {
|
||||
violations.push(`${ctx}: top-level keys must be [data, meta] — found [${keys.join(', ')}]. The handler returns { data, meta }; declare it with listEnvelope()/dataEnvelope().`)
|
||||
continue
|
||||
}
|
||||
|
||||
// Reference equality: both envelope helpers wire in this exact schema, so
|
||||
// a hand-rolled `{ data, meta: z.object({...}) }` that drifts from the
|
||||
// real meta block is rejected too.
|
||||
if (shape.meta !== ResponseMetaSchema) {
|
||||
violations.push(`${ctx}: meta is not the shared ResponseMetaSchema (use listEnvelope()/dataEnvelope(), don't hand-roll the envelope).`)
|
||||
}
|
||||
}
|
||||
|
||||
expect(
|
||||
violations,
|
||||
`\n${violations.length} v1 endpoint(s) declare a response.success that doesn't match the { data, meta } envelope the handler actually returns:\n\n${violations.map((v) => ` • ${v}`).join('\n')}\n`,
|
||||
).toEqual([])
|
||||
})
|
||||
|
||||
it('list endpoints expose data as an array (the paginated() envelope)', () => {
|
||||
// Detect list endpoints structurally: their `data` is a Zod array. This is
|
||||
// the half of the contract that maps onto paginated() specifically — guards
|
||||
// against a list endpoint drifting from `{ data: [...] }` back to a bare
|
||||
// `{ <name>: [...] }` (which would drop the array out of `data` entirely).
|
||||
const arrayDataEndpoints = endpoints.filter((ep) => {
|
||||
const s = ep.response.success
|
||||
return s instanceof z.ZodObject && (s as z.ZodObject<z.ZodRawShape>).shape.data instanceof z.ZodArray
|
||||
})
|
||||
|
||||
// The 10 cursor-paginated list endpoints (companies, customers, suppliers,
|
||||
// invoices, supplier-invoices, journal-entries, transactions, employees,
|
||||
// salary-runs, webhook deliveries). accounts/fiscal-periods/webhooks nest
|
||||
// their array under a named key inside `data`, so they use dataEnvelope and
|
||||
// are intentionally NOT counted here. A drop below this floor means a
|
||||
// paginated endpoint silently lost its `data: [...]` shape.
|
||||
expect(
|
||||
arrayDataEndpoints.length,
|
||||
`expected the known paginated list endpoints to keep data: z.array(...); found only ${arrayDataEndpoints.length}`,
|
||||
).toBeGreaterThanOrEqual(10)
|
||||
|
||||
for (const ep of arrayDataEndpoints) {
|
||||
const shape = (ep.response.success as z.ZodObject<z.ZodRawShape>).shape
|
||||
expect(
|
||||
shape.meta === ResponseMetaSchema,
|
||||
`${ep.method} ${ep.path}: list envelope meta must be the shared ResponseMetaSchema`,
|
||||
).toBe(true)
|
||||
}
|
||||
})
|
||||
|
||||
it('listEnvelope() and dataEnvelope() produce the canonical { data, meta } shape', () => {
|
||||
const list = listEnvelope(z.object({ id: z.string() }))
|
||||
expect(list instanceof z.ZodObject).toBe(true)
|
||||
expect(Object.keys(list.shape).sort()).toEqual(['data', 'meta'])
|
||||
expect(list.shape.data instanceof z.ZodArray).toBe(true)
|
||||
expect(list.shape.meta === ResponseMetaSchema).toBe(true)
|
||||
|
||||
const data = dataEnvelope(z.object({ id: z.string() }))
|
||||
expect(data instanceof z.ZodObject).toBe(true)
|
||||
expect(Object.keys(data.shape).sort()).toEqual(['data', 'meta'])
|
||||
expect(data.shape.data instanceof z.ZodObject).toBe(true)
|
||||
expect(data.shape.meta === ResponseMetaSchema).toBe(true)
|
||||
})
|
||||
|
||||
it('the shared meta schema carries request_id + api_version', () => {
|
||||
// The envelope helpers are only correct if meta itself is well-formed.
|
||||
expect(ResponseMetaSchema instanceof z.ZodObject).toBe(true)
|
||||
const metaKeys = Object.keys(ResponseMetaSchema.shape)
|
||||
expect(metaKeys).toContain('request_id')
|
||||
expect(metaKeys).toContain('api_version')
|
||||
})
|
||||
})
|
||||
+37
-5
@@ -21,15 +21,31 @@ import type { ZodTypeAny } from 'zod'
|
||||
import type { ApiKeyScope } from '@/lib/auth/api-keys'
|
||||
import { API_V1_VERSION } from './version'
|
||||
|
||||
/**
|
||||
* The audit block surfaced inline on write responses (see `AuditBlock` in
|
||||
* `lib/api/v1/response.ts`) so an agent gets the voucher number / audit-trail
|
||||
* URL without a second round-trip. Every field is optional.
|
||||
*/
|
||||
const ResponseAuditSchema = z.object({
|
||||
voucher_number: z.string().optional(),
|
||||
voucher_url: z.string().optional(),
|
||||
audit_trail_url: z.string().optional(),
|
||||
immutable_at: z.string().optional(),
|
||||
})
|
||||
|
||||
/**
|
||||
* The `meta` block echoed in every v1 response envelope (see
|
||||
* `lib/api/v1/response.ts`). List endpoints additionally populate
|
||||
* `next_cursor`; it is absent on the final page.
|
||||
* `next_cursor`; it is absent on the final page. Writes may surface an
|
||||
* `audit` block, and soft-degraded `?expand=` responses a `partial_expansions`
|
||||
* list — both optional, so reads and lists omit them.
|
||||
*/
|
||||
export const ResponseMetaSchema = z.object({
|
||||
request_id: z.string(),
|
||||
api_version: z.string(),
|
||||
next_cursor: z.string().nullable().optional(),
|
||||
audit: ResponseAuditSchema.optional(),
|
||||
partial_expansions: z.array(z.string()).optional(),
|
||||
})
|
||||
|
||||
/**
|
||||
@@ -66,6 +82,18 @@ export function dataEnvelope<T extends ZodTypeAny>(data: T) {
|
||||
})
|
||||
}
|
||||
|
||||
/**
|
||||
* Sentinel `response.success` for endpoints that return 204 No Content with an
|
||||
* empty body — e.g. DELETE handlers calling `noContent()`. The OpenAPI
|
||||
* generator emits a bare `204` response (no schema) for these instead of a
|
||||
* `200 { data, meta }`, and the envelope contract test exempts them.
|
||||
*
|
||||
* Identified by REFERENCE equality, so every 204 route MUST import this exact
|
||||
* constant rather than declaring its own `z.object({})` — that is what lets the
|
||||
* generator and the contract test recognise the "no body" intent.
|
||||
*/
|
||||
export const NoBodyResponse = z.object({})
|
||||
|
||||
export type HttpMethod = 'GET' | 'POST' | 'PATCH' | 'PUT' | 'DELETE'
|
||||
|
||||
export type ActionRisk = 'low' | 'medium' | 'high'
|
||||
@@ -327,6 +355,13 @@ export function generateOpenApiSpec(serverUrl: string): OpenApiSpec {
|
||||
? { [def.response.contentType]: { schema: { type: 'string', format: 'binary' } } }
|
||||
: { 'application/json': { schema: zodToJsonSchema(def.response.success) } }
|
||||
|
||||
// 204 No Content endpoints (DELETEs returning noContent()) carry no body —
|
||||
// emit a bare 204 instead of a 200 { data, meta } so the spec stops
|
||||
// advertising a response shape these handlers never send.
|
||||
const successResponse = def.response.success === NoBodyResponse
|
||||
? { '204': { description: 'No Content' } }
|
||||
: { '200': { description: 'Success', content: successContent } }
|
||||
|
||||
const operationDef: Record<string, unknown> = {
|
||||
operationId: def.operation,
|
||||
summary: def.summary,
|
||||
@@ -343,10 +378,7 @@ export function generateOpenApiSpec(serverUrl: string): OpenApiSpec {
|
||||
'x-dry-run-supported': def.dryRunSupported,
|
||||
...(def.scope ? { 'x-required-scope': def.scope } : {}),
|
||||
responses: {
|
||||
'200': {
|
||||
description: 'Success',
|
||||
content: successContent,
|
||||
},
|
||||
...successResponse,
|
||||
'400': { description: 'Validation error', $ref: '#/components/responses/Error' },
|
||||
'401': { description: 'Unauthorized', $ref: '#/components/responses/Error' },
|
||||
'403': { description: 'Insufficient scope', $ref: '#/components/responses/Error' },
|
||||
|
||||
Reference in New Issue
Block a user