Registry / database / grap-orm

grap-orm

JSON →
library1.0.1jsnpmunverified

GrapORM is an educational backend ORM built on Node.js and PostgreSQL, implementing a single-dispatch pattern where all business operations pass through a single endpoint (/to-process). It enforces session validation, permission checking, and method execution via reflection. Version 1.0.1 requires Node >=18 and a local PostgreSQL installation. Unlike traditional REST APIs, GrapORM centralizes security and allows adding new business objects without defining new routes. It caches permissions in memory for O(1) lookup. The project is released under an unspecified license and is currently in active development.

databasedevops
npm install grap-orm
github ↗package ↗homepage ↗
INSTALL
IMPORT
SIG · GRAP-ORM
G
grap-orm
databasejavascriptv1.0.1
harness data pending
Install & Compatibility
Where this runs

No compatibility data collected yet for this library.

Code
Verified usage

Verified import paths — ran on the pinned version, not inferred.

app
✓ const app = require('./app');
✗ import { app } from './app';
The project uses CommonJS (require) by default. ESM import may fail if package.json lacks 'type: module'.
Security
✓ const Security = require('./security/Security');
✗ import Security from './security/Security';
Security.js is loaded with require(). ESM default import may not work if module does not export default.
UserBO
✓ const UserBO = require('./bo/UserBO');
Business objects are required dynamically by path. Ensure bo/UserBO.js exists.

Shows basic Express setup with CORS, session, and a simplified /to-process endpoint that dynamically loads business objects and executes methods.

const express = require('express'); const cors = require('cors'); const session = require('express-session'); require('dotenv').config(); const app = express(); app.use(cors({ origin: process.env.ORIGIN || 'http://localhost:5173', credentials: true })); app.use(session({ secret: process.env.SESSION_SECRET || '', resave: false, saveUninitialized: false })); app.use(express.json()); // Single dispatch endpoint app.post('/to-process', (req, res) => { const { objectName, methodName, params } = req.body; if (!objectName || !methodName) { return res.status(400).json({ error: 'objectName and methodName are required' }); } // Validate session and permissions (simplified) if (!req.session.user) { return res.status(401).json({ error: 'Unauthorized' }); } try { const BO = require(`./bo/${objectName}`); const result = BO[methodName](params); res.json({ data: result }); } catch (err) { res.status(500).json({ error: err.message }); } }); app.listen(3000, () => console.log('GrapORM server running on port 3000'));
Debug
Known issues
breakingRequires Node.js 18+. Older versions may not run due to modern JS features and API usage.
fix
Upgrade to Node.js 18 or later.
affects: <18
breakingRequires PostgreSQL installed locally and accessible via psql/pg_restore. Database must be initialized with npm run init.
fix
Install PostgreSQL and ensure it is in PATH. Run 'npm run init' to create the database schema.
affects: >=0
deprecatedThe default import style may change to ESM in future releases. CommonJS require() is now encouraged.
fix
Use require() for now. When upgrading, check for ESM compatibility.
affects: <2
gotchaSecurity.js uses a whitelist of allowed business objects. Adding a new BO requires updating both bo/ and configs/bosconfig.json.
fix
Create the BO file in bo/ and add its name to allowedObjects in configs/bosconfig.json.
affects: >=1
gotchaThe /to-process endpoint does not perform input validation beyond session check. Malicious objectName or methodName could lead to arbitrary code execution if not restricted by whitelist.
fix
Ensure bosconfig.json contains only safe BO names. Avoid passing unsanitized user input to require().
affects: >=1
gotchaSession secret must be generated and set via SESSION_SECRET environment variable. Default is empty, which is insecure.
fix
Generate a random secret with node -e "console.log(require('crypto').randomBytes(32).toString('hex'))" and set it in .env.
affects: >=1
Errors
Common errors & fixes
Error: Cannot find module './bo/UserBO'
The business object file does not exist or the path is incorrect.
fix
Ensure the file exists at bo/UserBO.js and that the name matches exactly (case-sensitive).
Error: connect ECONNREFUSED 127.0.0.1:5432
PostgreSQL server is not running or connection details in configs/connections.json are wrong.
fix
Start PostgreSQL service and verify host/port in configs/connections.json.
Error: Permission denied. No session found.
The /to-process endpoint was called without a valid session cookie or the session expired.
fix
Ensure the user is logged in via /login first and that the session cookie is sent in the request.
TypeError: BO[methodName] is not a function
The method name provided does not exist on the business object, or the BO module does not export the expected method.
fix
Verify the method name spelling and ensure the BO exports the method as a function.
Upgrade
Version history
1.0.1latest on npm
Audit
Dependencies
pgrequiredPostgreSQL client for database connectivity
expressrequiredWeb framework for routing and middleware
corsrequiredCross-origin support
dotenvrequiredEnvironment variable loading
express-sessionrequiredSession management in Express
nodemaileroptionalEmail sending for password reset
Agent activity
12 hits · last 30 days
node
12
Resources
githubhttps://github.com/rcedenod/grap-orm ↗
packagegrap-orm ↗
homepagehttps://github.com/rcedenod/grap-orm#readme ↗
grap-orm — npm install grap-orm · libregistry