@appxdigital/appx-core 0.1.119 → 0.1.121-beta.4

package/dist/config/utils.js

@@ -23,8 +23,9 @@ var __importStar = (this && this.__importStar) || function (mod) {
     return result;
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.IGNORE_FOLDERS = exports.createFileIfNotExists = exports.kebabToPascalCase = void 0;
+exports.IGNORE_FOLDERS = exports.writeGeneratedFile = exports.GENERATED_BANNER = exports.createFileIfNotExists = exports.pascalToKebabCase = exports.kebabToPascalCase = void 0;
 const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
 const kebabToPascalCase = (str) => {
     return str
         .split("-")
@@ -32,9 +33,17 @@ const kebabToPascalCase = (str) => {
         .join("");
 };
 exports.kebabToPascalCase = kebabToPascalCase;
+const pascalToKebabCase = (str) => {
+    return str
+        .replace(/([a-z0-9])([A-Z])/g, '$1-$2')
+        .replace(/([A-Z]+)([A-Z][a-z])/g, '$1-$2')
+        .toLowerCase();
+};
+exports.pascalToKebabCase = pascalToKebabCase;
 const createFileIfNotExists = (filePath, content) => {
     console.log(`Creating ${filePath}...`);
     if (!fs.existsSync(filePath)) {
+        fs.mkdirSync(path.dirname(filePath), { recursive: true });
         fs.writeFileSync(filePath, content);
         console.log(`${filePath} created.`);
     }
@@ -43,9 +52,33 @@ const createFileIfNotExists = (filePath, content) => {
     }
 };
 exports.createFileIfNotExists = createFileIfNotExists;
+/**
+ * Banner stamped on every fully-generated file. These files live under
+ * `src/generated/` (gitignored) and are OVERWRITTEN on every `appx generate`.
+ * Never hand-edit them — customize the hand-owned subclass under
+ * `src/modules/<model>/dto/` instead.
+ */
+exports.GENERATED_BANNER = '// @Generated by appx-core — do not edit.\n' +
+    '// Regenerated by `appx generate`; lives under src/generated (gitignored).\n' +
+    '// To customize, edit the hand-owned subclass in src/modules/<model>/dto.\n';
+/**
+ * Writes a fully-generated file, always overwriting. Use only for artifacts
+ * under `src/generated/` that carry {@link GENERATED_BANNER}. Creates parent
+ * directories as needed.
+ */
+const writeGeneratedFile = (filePath, content) => {
+    fs.mkdirSync(path.dirname(filePath), { recursive: true });
+    fs.writeFileSync(filePath, content);
+    console.log(`Generated ${filePath}`);
+};
+exports.writeGeneratedFile = writeGeneratedFile;
 exports.IGNORE_FOLDERS = [
     'prisma',
     'schema.gql',
     'session',
-    'user-refresh-token'
+    'user-refresh-token',
+    // Generated DTOs live under src/generated/dto/. The model generators scan
+    // src/generated's top-level dirs as model names, so this must be skipped or
+    // they emit a bogus `dto` module.
+    'dto',
 ];

package/dist/index.d.ts

@@ -22,6 +22,8 @@ export * from './common/interfaces/storage-service.interface';
 export * from './modules/file/file-upload.controller';
 export * from './modules/file/file-upload.service';
 export * from './common/decorators/permission.decorator';
+export * from './common/setup/setup-core-security';
+export * from './common/setup/core-config';
 export * from './common/interceptors/file.interceptor';
 export * from './modules/auth/authenticated.guard';
 export * from './modules/auth/jwt-auth.guard';

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,4BAA4B,CAAC;AAC3C,cAAc,6BAA6B,CAAC;AAC5C,cAAc,gCAAgC,CAAC;AAC/C,cAAc,yBAAyB,CAAC;AACxC,cAAc,0BAA0B,CAAC;AACzC,cAAc,4BAA4B,CAAC;AAC3C,cAAc,iCAAiC,CAAC;AAChD,cAAc,4BAA4B,CAAC;AAC3C,cAAc,sCAAsC,CAAC;AACrD,cAAc,4BAA4B,CAAC;AAC3C,cAAc,uCAAuC,CAAC;AACtD,cAAc,yBAAyB,CAAC;AACxC,cAAc,0CAA0C,CAAC;AACzD,cAAc,wCAAwC,CAAC;AACvD,cAAc,iCAAiC,CAAC;AAChD,cAAc,6CAA6C,CAAC;AAC5D,cAAc,oBAAoB,CAAC;AACnC,cAAc,mCAAmC,CAAC;AAClD,cAAc,2CAA2C,CAAC;AAC1D,cAAc,wCAAwC,CAAC;AACvD,cAAc,+CAA+C,CAAC;AAC9D,cAAc,uCAAuC,CAAC;AACtD,cAAc,oCAAoC,CAAC;AACnD,cAAc,0CAA0C,CAAC;AACzD,cAAc,wCAAwC,CAAC;AACvD,cAAc,oCAAoC,CAAC;AACnD,cAAc,+BAA+B,CAAC;AAC9C,cAAc,qCAAqC,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,4BAA4B,CAAC;AAC3C,cAAc,6BAA6B,CAAC;AAC5C,cAAc,gCAAgC,CAAC;AAC/C,cAAc,yBAAyB,CAAC;AACxC,cAAc,0BAA0B,CAAC;AACzC,cAAc,4BAA4B,CAAC;AAC3C,cAAc,iCAAiC,CAAC;AAChD,cAAc,4BAA4B,CAAC;AAC3C,cAAc,sCAAsC,CAAC;AACrD,cAAc,4BAA4B,CAAC;AAC3C,cAAc,uCAAuC,CAAC;AACtD,cAAc,yBAAyB,CAAC;AACxC,cAAc,0CAA0C,CAAC;AACzD,cAAc,wCAAwC,CAAC;AACvD,cAAc,iCAAiC,CAAC;AAChD,cAAc,6CAA6C,CAAC;AAC5D,cAAc,oBAAoB,CAAC;AACnC,cAAc,mCAAmC,CAAC;AAClD,cAAc,2CAA2C,CAAC;AAC1D,cAAc,wCAAwC,CAAC;AACvD,cAAc,+CAA+C,CAAC;AAC9D,cAAc,uCAAuC,CAAC;AACtD,cAAc,oCAAoC,CAAC;AACnD,cAAc,0CAA0C,CAAC;AACzD,cAAc,oCAAoC,CAAC;AACnD,cAAc,4BAA4B,CAAC;AAC3C,cAAc,wCAAwC,CAAC;AACvD,cAAc,oCAAoC,CAAC;AACnD,cAAc,+BAA+B,CAAC;AAC9C,cAAc,qCAAqC,CAAC"}

package/dist/index.js

@@ -38,6 +38,8 @@ __exportStar(require("./common/interfaces/storage-service.interface"), exports);
 __exportStar(require("./modules/file/file-upload.controller"), exports);
 __exportStar(require("./modules/file/file-upload.service"), exports);
 __exportStar(require("./common/decorators/permission.decorator"), exports);
+__exportStar(require("./common/setup/setup-core-security"), exports);
+__exportStar(require("./common/setup/core-config"), exports);
 __exportStar(require("./common/interceptors/file.interceptor"), exports);
 __exportStar(require("./modules/auth/authenticated.guard"), exports);
 __exportStar(require("./modules/auth/jwt-auth.guard"), exports);

package/dist/modules/auth/auth.controller.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth.controller.d.ts","sourceRoot":"","sources":["../../../src/modules/auth/auth.controller.ts"],"names":[],"mappings":"AACA,OAAO,EAAC,WAAW,EAAC,MAAM,gBAAgB,CAAC;AAC3C,OAAO,EAAC,WAAW,EAAC,MAAM,oBAAoB,CAAC;AAG/C,OAAO,EAAC,OAAO,EAAE,QAAQ,EAAC,MAAM,SAAS,CAAC;AAI1C,qBACa,cAAc;IACX,SAAS,CAAC,QAAQ,CAAC,WAAW,EAAE,WAAW;gBAAxB,WAAW,EAAE,WAAW;IAGjD,QAAQ,CAAS,WAAW,EAAE,WAAW;;;;IAMzC,KAAK,CAAQ,GAAG,EAAE,OAAO,EAAS,GAAG,EAAE,QAAQ;IAW/C,MAAM,CAAQ,GAAG,EAAE,OAAO,EAAS,GAAG,EAAE,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC;IAoBhE,EAAE,CAAQ,GAAG,EAAE,OAAO;;;IAQtB,iBAAiB,CAAQ,GAAG,EAAE,OAAO;;;IAOrC,gBAAgB,CAAQ,GAAG,EAAE,OAAO,EAAS,GAAG,EAAE,QAAQ;IAK1D,cAAc,CAAkB,MAAM,EAAE,MAAM,EAAS,GAAG,EAAE,OAAO;;;IAUnE,oBAAoB,CACF,SAAS,EAAE,MAAM,EAC9B,GAAG,EAAE,OAAO,EACZ,GAAG,EAAE,QAAQ;IAgBlB,QAAQ,CAAQ,GAAG,EAAE,OAAO;;;;;IAM5B,aAAa,CAAQ,GAAG,EAAE,OAAO;;;;IAOjC,SAAS,CAAQ,GAAG,EAAE,OAAO;;;CAQtC"}
+{"version":3,"file":"auth.controller.d.ts","sourceRoot":"","sources":["../../../src/modules/auth/auth.controller.ts"],"names":[],"mappings":"AACA,OAAO,EAAC,WAAW,EAAC,MAAM,gBAAgB,CAAC;AAC3C,OAAO,EAAC,WAAW,EAAC,MAAM,oBAAoB,CAAC;AAG/C,OAAO,EAAC,OAAO,EAAE,QAAQ,EAAC,MAAM,SAAS,CAAC;AAI1C,qBACa,cAAc;IACX,SAAS,CAAC,QAAQ,CAAC,WAAW,EAAE,WAAW;gBAAxB,WAAW,EAAE,WAAW;IAGjD,QAAQ,CAAS,WAAW,EAAE,WAAW;;;;IAMzC,KAAK,CAAQ,GAAG,EAAE,OAAO,EAAS,GAAG,EAAE,QAAQ;IAW/C,MAAM,CAAQ,GAAG,EAAE,OAAO,EAAS,GAAG,EAAE,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC;IAoBhE,EAAE,CAAQ,GAAG,EAAE,OAAO;;;IAQtB,iBAAiB,CAAQ,GAAG,EAAE,OAAO;;;IAOrC,gBAAgB,CAAQ,GAAG,EAAE,OAAO,EAAS,GAAG,EAAE,QAAQ;IAM1D,cAAc,CAAkB,MAAM,EAAE,MAAM,EAAS,GAAG,EAAE,OAAO;;;IAanE,oBAAoB,CACF,SAAS,EAAE,MAAM,EAC9B,GAAG,EAAE,OAAO,EACZ,GAAG,EAAE,QAAQ;IAgBlB,QAAQ,CAAQ,GAAG,EAAE,OAAO;;;;;IAM5B,aAAa,CAAQ,GAAG,EAAE,OAAO;;;;IAOjC,SAAS,CAAQ,GAAG,EAAE,OAAO;;;CAQtC"}

package/dist/modules/auth/auth.controller.js

@@ -64,7 +64,9 @@ let AuthController = exports.AuthController = class AuthController {
         return this.authService.closeAllUserSessions(req, res);
     }
     async getAllSessions(userId, req) {
-        //TODO - Implement a more dynamic way to handle role access
+        // AuthenticatedGuard gates authentication explicitly; the role check
+        // below is the authorization step. De-hardcoding 'ADMIN' into the
+        // permissions system is deferred (see ROADMAP / ).
         if (req.user?.role !== 'ADMIN') {
             throw new common_1.ForbiddenException('Access denied.');
         }
@@ -72,7 +74,7 @@ let AuthController = exports.AuthController = class AuthController {
         return { sessions };
     }
     async closeSpecificSession(sessionId, req, res) {
-        //TODO - Implement a more dynamic way to handle role access
+        // See getAllSessions: AuthenticatedGuard = authn, role check = authz.
         if (req.user?.role !== 'ADMIN') {
             throw new common_1.ForbiddenException('Access denied.');
         }
@@ -151,6 +153,7 @@ __decorate([
     __metadata("design:returntype", Promise)
 ], AuthController.prototype, "closeAllSessions", null);
 __decorate([
+    (0, common_1.UseGuards)(authenticated_guard_1.AuthenticatedGuard),
     (0, common_1.Get)('sessions/:userId'),
     __param(0, (0, common_1.Param)('userId')),
     __param(1, (0, common_1.Req)()),
@@ -159,6 +162,7 @@ __decorate([
     __metadata("design:returntype", Promise)
 ], AuthController.prototype, "getAllSessions", null);
 __decorate([
+    (0, common_1.UseGuards)(authenticated_guard_1.AuthenticatedGuard),
     (0, common_1.Post)('sessions/:sessionId/close'),
     __param(0, (0, common_1.Param)('sessionId')),
     __param(1, (0, common_1.Req)()),

package/dist/modules/auth/auth.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth.service.d.ts","sourceRoot":"","sources":["../../../src/modules/auth/auth.service.ts"],"names":[],"mappings":"AACA,OAAO,EAAC,WAAW,EAAC,MAAM,sBAAsB,CAAC;AACjD,OAAO,EAAC,WAAW,EAAC,MAAM,oBAAoB,CAAC;AAE/C,OAAO,EAAC,aAAa,EAAC,MAAM,6BAA6B,CAAC;AAC1D,OAAO,EAAC,aAAa,EAAC,MAAM,gBAAgB,CAAC;AAC7C,OAAO,EAAC,OAAO,EAAE,QAAQ,EAAC,MAAM,SAAS,CAAC;AAC1C,OAAO,EAAC,UAAU,EAAC,MAAM,aAAa,CAAC;AAKvC,qBACa,WAAW;IAIhB,SAAS,CAAC,QAAQ,CAAC,WAAW,EAAE,WAAW;IAC3C,SAAS,CAAC,QAAQ,CAAC,MAAM,EAAE,aAAa;IACxC,SAAS,CAAC,QAAQ,CAAC,UAAU,EAAE,UAAU;IACzC,SAAS,CAAC,QAAQ,CAAC,aAAa,EAAE,aAAa;IANnD,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAS;gBAGpB,WAAW,EAAE,WAAW,EACxB,MAAM,EAAE,aAAa,EACrB,UAAU,EAAE,UAAU,EACtB,aAAa,EAAE,aAAa;IAK7C,QAAQ,CAAC,WAAW,EAAE,WAAW;;;;IA2BjC,KAAK,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,GAAG,CAAA;KAAC,CAAC;IA8B1D,MAAM,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC;IAgBlD,YAAY,CACd,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,MAAM,EAChB,aAAa,EAAE,MAAM,GACtB,OAAO,CAAC,GAAG,CAAC;IAuBT,cAAc,CAAC,GAAG,EAAE,OAAO;IAW3B,iBAAiB,CAAC,GAAG,EAAE,OAAO;IAW9B,oBAAoB,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ;IA0BhD,mBAAmB,CAAC,MAAM,EAAE,MAAM;IAMlC,oBAAoB,CAAC,SAAS,EAAE,MAAM;IAOtC,kBAAkB,CAAC,OAAO,EAAE,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC;YActC,cAAc;IAkCtB,aAAa,CAAC,yBAAyB,EAAE,GAAG,GAAG,OAAO,CAAC;QAAC,YAAY,EAAE,MAAM,CAAC;QAAC,aAAa,EAAE,MAAM,CAAA;KAAC,CAAC;IA4B3G,OAAO,CAAC,WAAW;IAUb,QAAQ,CAAC,iBAAiB,EAAE,GAAG,GAAG,OAAO,CAAC;QAAC,YAAY,EAAE,MAAM,CAAC;QAAC,aAAa,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,GAAG,CAAA;KAAC,CAAC;IAcnG,0BAA0B,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAUlE"}
+{"version":3,"file":"auth.service.d.ts","sourceRoot":"","sources":["../../../src/modules/auth/auth.service.ts"],"names":[],"mappings":"AACA,OAAO,EAAC,WAAW,EAAC,MAAM,sBAAsB,CAAC;AACjD,OAAO,EAAC,WAAW,EAAC,MAAM,oBAAoB,CAAC;AAE/C,OAAO,EAAC,aAAa,EAAC,MAAM,6BAA6B,CAAC;AAC1D,OAAO,EAAC,aAAa,EAAC,MAAM,gBAAgB,CAAC;AAC7C,OAAO,EAAC,OAAO,EAAE,QAAQ,EAAC,MAAM,SAAS,CAAC;AAC1C,OAAO,EAAC,UAAU,EAAiB,MAAM,aAAa,CAAC;AAKvD,qBACa,WAAW;IAIhB,SAAS,CAAC,QAAQ,CAAC,WAAW,EAAE,WAAW;IAC3C,SAAS,CAAC,QAAQ,CAAC,MAAM,EAAE,aAAa;IACxC,SAAS,CAAC,QAAQ,CAAC,UAAU,EAAE,UAAU;IACzC,SAAS,CAAC,QAAQ,CAAC,aAAa,EAAE,aAAa;IANnD,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAS;gBAGpB,WAAW,EAAE,WAAW,EACxB,MAAM,EAAE,aAAa,EACrB,UAAU,EAAE,UAAU,EACtB,aAAa,EAAE,aAAa;IAK7C,QAAQ,CAAC,WAAW,EAAE,WAAW;;;;IA2BjC,KAAK,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,GAAG,CAAA;KAAC,CAAC;IA8B1D,MAAM,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC;IAgBlD,YAAY,CACd,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,MAAM,EAChB,aAAa,EAAE,MAAM,GACtB,OAAO,CAAC,GAAG,CAAC;IAuBT,cAAc,CAAC,GAAG,EAAE,OAAO;IAW3B,iBAAiB,CAAC,GAAG,EAAE,OAAO;IAW9B,oBAAoB,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ;IA0BhD,mBAAmB,CAAC,MAAM,EAAE,MAAM;IAMlC,oBAAoB,CAAC,SAAS,EAAE,MAAM;IAOtC,kBAAkB,CAAC,OAAO,EAAE,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC;YActC,cAAc;IAkCtB,aAAa,CAAC,yBAAyB,EAAE,GAAG,GAAG,OAAO,CAAC;QAAC,YAAY,EAAE,MAAM,CAAC;QAAC,aAAa,EAAE,MAAM,CAAA;KAAC,CAAC;IA4B3G,OAAO,CAAC,WAAW;IAUb,QAAQ,CAAC,iBAAiB,EAAE,GAAG,GAAG,OAAO,CAAC;QAAC,YAAY,EAAE,MAAM,CAAC;QAAC,aAAa,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,GAAG,CAAA;KAAC,CAAC;IAcnG,0BAA0B,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAUlE"}

package/dist/modules/core/core.controller.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"core.controller.d.ts","sourceRoot":"","sources":["../../../src/modules/core/core.controller.ts"],"names":[],"mappings":"AACA,OAAO,EAAC,WAAW,EAAC,MAAM,gBAAgB,CAAC;AAI3C,OAAO,EAAC,kBAAkB,EAAC,MAAM,yCAAyC,CAAC;AAQ3E,8BACsB,cAAc,CAAC,CAAC;IAM9B,SAAS,CAAC,QAAQ,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC,CAAC;IAL9C,MAAM,KAAK,UAAU,IAAI,MAAM,CAE9B;IAED,SAAS,aACc,OAAO,EAAE,WAAW,CAAC,CAAC,CAAC;IAK9C,SAAS,CAAC,QAAQ,CAAC,kBAAkB,EAAG,kBAAkB,CAAC;IAIrD,OAAO;IAMP,OAAO,CAAc,EAAE,EAAE,MAAM;IAM/B,MAAM,CAAS,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC,GAAG;QAAC,CAAC,GAAG,EAAE,MAAM,GAAG,GAAG,CAAA;KAAC;IAoBtD,MAAM,CAAc,EAAE,EAAE,MAAM,EAAU,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC;IAoBxD,MAAM,CAAc,EAAE,EAAE,MAAM;CAGvC"}
+{"version":3,"file":"core.controller.d.ts","sourceRoot":"","sources":["../../../src/modules/core/core.controller.ts"],"names":[],"mappings":"AACA,OAAO,EAAC,WAAW,EAAC,MAAM,gBAAgB,CAAC;AAI3C,OAAO,EAAC,kBAAkB,EAAC,MAAM,yCAAyC,CAAC;AAS3E,8BACsB,cAAc,CAAC,CAAC;IAM9B,SAAS,CAAC,QAAQ,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC,CAAC;IAL9C,MAAM,KAAK,UAAU,IAAI,MAAM,CAE9B;IAED,SAAS,aACc,OAAO,EAAE,WAAW,CAAC,CAAC,CAAC;IAK9C,SAAS,CAAC,QAAQ,CAAC,kBAAkB,EAAG,kBAAkB,CAAC;IAIrD,OAAO;IAMP,OAAO,CAAc,EAAE,EAAE,MAAM;IAM/B,MAAM,CAAS,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC,GAAG;QAAC,CAAC,GAAG,EAAE,MAAM,GAAG,GAAG,CAAA;KAAC;IAuBtD,MAAM,CAAc,EAAE,EAAE,MAAM,EAAU,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC;IAsBxD,MAAM,CAAc,EAAE,EAAE,MAAM;CAGvC"}

package/dist/modules/core/core.controller.js

@@ -39,10 +39,15 @@ let CoreController = exports.CoreController = CoreController_1 = class CoreContr
         const model = this.constructor.entityName;
         const rolePermissions = this.permissionsService.getPermissionsConfig()[model]?.[role];
         const actionPermission = rolePermissions?.['create'];
-        if (typeof actionPermission !== 'string' &&
-            actionPermission?.setUserIdField) {
-            const userIdField = actionPermission.setUserIdField;
-            data[userIdField] = user.id;
+        if (typeof actionPermission !== 'string' && actionPermission) {
+            // Strip restricted fields first, then force the server-owned user id
+            // (so setUserIdField cannot be clobbered by a restricted-field strip).
+            for (const field of (actionPermission.restrictedFields ?? [])) {
+                delete data[field];
+            }
+            if (actionPermission.setUserIdField) {
+                data[actionPermission.setUserIdField] = user.id;
+            }
         }
         return this.service.create(data);
     }
@@ -51,7 +56,9 @@ let CoreController = exports.CoreController = CoreController_1 = class CoreContr
         const role = user?.role || 'GUEST';
         const model = this.constructor.entityName;
         const rolePermissions = this.permissionsService.getPermissionsConfig()[model]?.[role];
-        const actionPermission = rolePermissions?.['update'];
+        // The action key is 'updateMany' (matches @Permission('updateMany') and
+        // the proxy) — reading 'update' here meant restrictedFields never applied.
+        const actionPermission = rolePermissions?.['updateMany'];
         let restrictedFields = [];
         if (typeof actionPermission !== 'string' && actionPermission?.restrictedFields) {
             restrictedFields = actionPermission.restrictedFields;

package/dist/modules/user/user.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"user.service.d.ts","sourceRoot":"","sources":["../../../src/modules/user/user.service.ts"],"names":[],"mappings":"AACA,OAAO,EAAC,aAAa,EAAC,MAAM,6BAA6B,CAAC;AAC1D,OAAO,EAAC,eAAe,EAAC,MAAM,wCAAwC,CAAC;AACvE,OAAO,EAAC,WAAW,EAAC,MAAM,sBAAsB,CAAC;AAEjD,OAAO,EAAC,IAAI,EAAC,MAAM,gBAAgB,CAAC;AAEpC,qBACa,WAAY,SAAQ,WAAW,CAAC,IAAI,CAAC;IAClC,SAAS,CAAC,MAAM,EAAE,aAAa;gBAArB,MAAM,EAAE,aAAa;IAIrC,UAAU,CAAC,eAAe,EAAE,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC;IAM3D,WAAW,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC;IAUpD,WAAW,CAAC,KAAK,EAAE,MAAM;CAYlC"}
+{"version":3,"file":"user.service.d.ts","sourceRoot":"","sources":["../../../src/modules/user/user.service.ts"],"names":[],"mappings":"AACA,OAAO,EAAC,aAAa,EAAC,MAAM,6BAA6B,CAAC;AAC1D,OAAO,EAAC,eAAe,EAAC,MAAM,wCAAwC,CAAC;AACvE,OAAO,EAAC,WAAW,EAAC,MAAM,sBAAsB,CAAC;AAEjD,OAAO,EAAC,IAAI,EAAC,MAAM,gBAAgB,CAAC;AAEpC,qBACa,WAAY,SAAQ,WAAW,CAAC,IAAI,CAAC;IAClC,SAAS,CAAC,MAAM,EAAE,aAAa;gBAArB,MAAM,EAAE,aAAa;IAIrC,UAAU,CAAC,eAAe,EAAE,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC;IAY3D,WAAW,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC;IAUpD,WAAW,CAAC,KAAK,EAAE,MAAM;CAYlC"}

package/dist/modules/user/user.service.js

@@ -19,9 +19,13 @@ let UserService = exports.UserService = class UserService extends core_service_1
         this.prisma = prisma;
     }
     async createUser(createUserInput) {
-        return this.prisma.user.create({
-            data: createUserInput,
-        });
+        // Registration is an unauthenticated framework flow (role GUEST has no
+        // create permission). Its input is already constrained by RegisterDto,
+        // so bypass access filtering — otherwise the create default-deny would
+        // reject sign-up.
+        return this.prisma.user.create({ data: createUserInput }, 
+        // @ts-ignore — options arg is accepted by the proxy delegate
+        { BYPASS_FILTERING: true });
     }
     async findByField(field, value) {
         const where = {

package/dist/prisma/prisma.service.d.ts

@@ -17,6 +17,13 @@ export declare class PrismaService {
     private readonly permissionsConfig;
     private fieldConfigs;
     prismaClient: PrismaClient;
+    /**
+     * The un-proxied Prisma client. Used internally (e.g. create-condition
+     * checks) to look up an already-existing parent row without re-applying
+     * that model's access filtering — matching "would a findFirst with these
+     * conditions match".
+     */
+    private rawClient;
     constructor(prismaClient: PrismaClient, permissionsConfig: PermissionsConfigType);
     debugQueries(enable: boolean): void;
     withExposedModels(models: string[], callback: () => Promise<void>): Promise<void>;
@@ -62,6 +69,44 @@ export declare class PrismaService {
      * @throws ForbiddenException if no valid `where` conditions are present after applying permissions.
      */
     private applyWhereConditions;
+    /**
+     * Enforces permission `conditions` on `create` / `createMany`.
+     *
+     * Conditions cannot be pushed into a `WHERE` on insert, so instead we verify
+     * the incoming data *would* satisfy them — i.e. a `findFirst` with those
+     * conditions would return the new row. Own-scalar fields are checked against
+     * `data`; relation conditions are checked by looking up the referenced parent
+     * (which lets Prisma evaluate arbitrarily-nested relation conditions for us).
+     *
+     * Also default-denies: create is only allowed for a role/action that has an
+     * explicit permission (or 'ALL'), mirroring find/update/delete. Framework
+     * flows that must create without a permission (registration, sessions,
+     * tokens) pass BYPASS_FILTERING and never reach here.
+     *
+     * Fails **closed**: throws on a violation and on any condition shape it
+     * cannot evaluate, rather than silently allowing the insert.
+     */
+    private enforceCreateConditions;
+    /**
+     * True only in an explicit local-development environment. Deliberately NOT
+     * `!== 'production'` — staging and other envs should behave like production
+     * (no extra diagnostic queries/logging). Only `development` / `dev` opt in.
+     */
+    private isDevMode;
+    /**
+     * Dev-only diagnostic. After a create that passed its create-conditions,
+     * checks whether the new row also satisfies the model's *find* conditions —
+     * if not, the creator can't read it back (create rule broader than find
+     * rule). Logs a warning; never affects the create. Runs only in development
+     * (gated by the caller).
+     */
+    private warnIfCreatedRowNotFindable;
+    /** Recursively evaluates a (placeholder-resolved) condition object against a to-be-created row. */
+    private matchesCreateConditions;
+    /** Evaluates a scalar-field condition (value or Prisma operator object) against the row's value. */
+    private matchesCreateScalar;
+    /** Verifies the parent referenced by a belongsTo condition exists and satisfies the nested condition. */
+    private matchesCreateRelation;
     /**
      * Builds dynamic conditions based on the type of clause (OR, AND, or field conditions).
      * Each condition is processed, and placeholders (like `$USER_ID`) are replaced with actual values.

package/dist/prisma/prisma.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"prisma.service.d.ts","sourceRoot":"","sources":["../../src/prisma/prisma.service.ts"],"names":[],"mappings":";AACA,OAAO,EAAC,MAAM,EAAE,YAAY,EAAC,MAAM,gBAAgB,CAAC;AACpD,OAAO,EAAC,qBAAqB,EAAC,MAAM,yCAAyC,CAAC;AAE9E,OAAO,KAAK,EAAC,YAAY,IAAI,aAAa,EAAC,MAAM,gBAAgB,CAAC;AAGlE,OAAO,EAAC,iBAAiB,EAAC,MAAM,kBAAkB,CAAC;AAEnD,eAAO,MAAM,iBAAiB;mBACX,MAAM,EAAE;EACvB,CAAC;AAEL,KAAK,QAAQ,GAAG,MAAM,aAAa,CAAC;AAEpC,oDAAoD;AACpD,MAAM,MAAM,iBAAiB,GAAG;IAC5B,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,gBAAgB,CAAC,EAAE,OAAO,CAAC;CAC9B,CAAC;AAGF,MAAM,MAAM,eAAe,CAAC,CAAC,SAAS,QAAQ,IAAI,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,YAAY,GAAG,mBAAmB,GAAG,QAAQ,GAAG,QAAQ,CAAC,CAAC;AAEtI,qBACa,aAAa;IAMY,OAAO,CAAC,QAAQ,CAAC,iBAAiB;IALpE,OAAO,CAAC,YAAY,CAA2B;IAC/C,YAAY,EAAE,YAAY,CAAC;gBAGvB,YAAY,EAAE,YAAY,EACqB,iBAAiB,EAAE,qBAAqB;IAO3F,YAAY,CAAC,MAAM,EAAE,OAAO;IAO5B,iBAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC;IAWjE,OAAO,CAAC,KAAK;IAQb,YAAY,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,iBAAiB,KAAK,OAAO,CAAC,CAAC,CAAC;IAIpE,WAAW;IAuDX;;;;OAIG;IACH,gBAAgB,CAAC,CAAC,SAAS,QAAQ,EAAE,KAAK,EAAE,CAAC,GAAG,eAAe,CAAC,CAAC,CAAC;IAYlE,IAAI,KAAK,IAAI,aAAa,CAUzB;IAED,IAAI,IAAI,IAAI,eAAe,CAAC,MAAM,CAAC,CAElC;IAED,IAAI,OAAO,IAAI,eAAe,CAAC,SAAS,CAAC,CAExC;IAED,IAAI,gBAAgB,QAEnB;IAED;;;OAGG;IACH,WAAW;IAqDX;;;;;;;;OAQG;IACH,OAAO,CAAC,kBAAkB;IAqC1B,IAAI,2BAA2B,QAM9B;IAED;;;;;;;;;;;OAWG;IACH,OAAO,CAAC,oBAAoB;IA8K5B;;;;;;;OAOG;WACW,gBAAgB,CAAC,UAAU,EAAE,GAAG,EAAE,EAAE,IAAI,EAAE,GAAG,GAAG,GAAG;IAgBjE;;;;;;;OAOG;IACH,OAAO,CAAC,MAAM,CAAC,mBAAmB;IA2BlC;;;;;;;OAOG;IACH,OAAO,CAAC,eAAe;IAUvB;;;;;;;;;;OAUG;IACH,OAAO,CAAC,iBAAiB;IA8EzB,WAAW,CAAC,WAAW,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,eAAe,CAAC,EAAE,IAAI,GAAG;QAC5E,KAAK,EAAE,MAAM,CAAC;QACd,QAAQ,EAAE,MAAM,CAAC;QACjB,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,iBAAiB,CAAC,EAAE,MAAM,CAAC;QAC3B,UAAU,EAAE,OAAO,CAAA;KACtB;IAmBD,gBAAgB,CAAC,WAAW,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM;CAgBzF"}
+{"version":3,"file":"prisma.service.d.ts","sourceRoot":"","sources":["../../src/prisma/prisma.service.ts"],"names":[],"mappings":";AACA,OAAO,EAAC,MAAM,EAAE,YAAY,EAAC,MAAM,gBAAgB,CAAC;AACpD,OAAO,EAAC,qBAAqB,EAAC,MAAM,yCAAyC,CAAC;AAE9E,OAAO,KAAK,EAAC,YAAY,IAAI,aAAa,EAAC,MAAM,gBAAgB,CAAC;AAGlE,OAAO,EAAC,iBAAiB,EAAC,MAAM,kBAAkB,CAAC;AAEnD,eAAO,MAAM,iBAAiB;mBACX,MAAM,EAAE;EACvB,CAAC;AAEL,KAAK,QAAQ,GAAG,MAAM,aAAa,CAAC;AAEpC,oDAAoD;AACpD,MAAM,MAAM,iBAAiB,GAAG;IAC5B,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,gBAAgB,CAAC,EAAE,OAAO,CAAC;CAC9B,CAAC;AAGF,MAAM,MAAM,eAAe,CAAC,CAAC,SAAS,QAAQ,IAAI,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,YAAY,GAAG,mBAAmB,GAAG,QAAQ,GAAG,QAAQ,CAAC,CAAC;AAEtI,qBACa,aAAa;IAaY,OAAO,CAAC,QAAQ,CAAC,iBAAiB;IAZpE,OAAO,CAAC,YAAY,CAA2B;IAC/C,YAAY,EAAE,YAAY,CAAC;IAC3B;;;;;OAKG;IACH,OAAO,CAAC,SAAS,CAAgB;gBAG7B,YAAY,EAAE,YAAY,EACqB,iBAAiB,EAAE,qBAAqB;IAO3F,YAAY,CAAC,MAAM,EAAE,OAAO;IAO5B,iBAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC;IAWjE,OAAO,CAAC,KAAK;IAQb,YAAY,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,iBAAiB,KAAK,OAAO,CAAC,CAAC,CAAC;IAIpE,WAAW;IAwEX;;;;OAIG;IACH,gBAAgB,CAAC,CAAC,SAAS,QAAQ,EAAE,KAAK,EAAE,CAAC,GAAG,eAAe,CAAC,CAAC,CAAC;IAYlE,IAAI,KAAK,IAAI,aAAa,CAUzB;IAED,IAAI,IAAI,IAAI,eAAe,CAAC,MAAM,CAAC,CAElC;IAED,IAAI,OAAO,IAAI,eAAe,CAAC,SAAS,CAAC,CAExC;IAED,IAAI,gBAAgB,QAEnB;IAED;;;OAGG;IACH,WAAW;IAqDX;;;;;;;;OAQG;IACH,OAAO,CAAC,kBAAkB;IAqC1B,IAAI,2BAA2B,QAM9B;IAED;;;;;;;;;;;OAWG;IACH,OAAO,CAAC,oBAAoB;IA8K5B;;;;;;;;;;;;;;;;OAgBG;YACW,uBAAuB;IAgDrC;;;;OAIG;IACH,OAAO,CAAC,SAAS;IAKjB;;;;;;OAMG;YACW,2BAA2B;IAqBzC,mGAAmG;YACrF,uBAAuB;IAiCrC,oGAAoG;IACpG,OAAO,CAAC,mBAAmB;IAwB3B,yGAAyG;YAC3F,qBAAqB;IAuBnC;;;;;;;OAOG;WACW,gBAAgB,CAAC,UAAU,EAAE,GAAG,EAAE,EAAE,IAAI,EAAE,GAAG,GAAG,GAAG;IAgBjE;;;;;;;OAOG;IACH,OAAO,CAAC,MAAM,CAAC,mBAAmB;IA2BlC;;;;;;;OAOG;IACH,OAAO,CAAC,eAAe;IAUvB;;;;;;;;;;OAUG;IACH,OAAO,CAAC,iBAAiB;IA8EzB,WAAW,CAAC,WAAW,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,eAAe,CAAC,EAAE,IAAI,GAAG;QAC5E,KAAK,EAAE,MAAM,CAAC;QACd,QAAQ,EAAE,MAAM,CAAC;QACjB,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,iBAAiB,CAAC,EAAE,MAAM,CAAC;QAC3B,UAAU,EAAE,OAAO,CAAA;KACtB;IAmBD,gBAAgB,CAAC,WAAW,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM;CAgBzF"}

package/dist/prisma/prisma.service.js

@@ -54,6 +54,10 @@ let PrismaService = exports.PrismaService = PrismaService_1 = class PrismaServic
         return this.prismaClient.$transaction(fn);
     }
     proxyModels() {
+        // Capture the un-proxied client before wrapping it (used by internal
+        // lookups that must bypass this proxy's access filtering — see
+        // enforceCreateConditions).
+        this.rawClient = this.prismaClient;
         // Proxy client to intercept model calls
         this.prismaClient = new Proxy(this.prismaClient, {
             get: (target, propKey) => {
@@ -85,8 +89,15 @@ let PrismaService = exports.PrismaService = PrismaService_1 = class PrismaServic
                                     else {
                                         this.debug(`Skipping field omission for ${String(propKey)}.${String(methodKey)}()`);
                                     }
-                                    if (!options?.BYPASS_FILTERING && !['create', 'createMany'].includes(methodKey.toString())) {
-                                        params = this.applyWhereConditions(String(propKey), userRole, params, user, methodKey);
+                                    if (!options?.BYPASS_FILTERING) {
+                                        if (['create', 'createMany'].includes(methodKey.toString())) {
+                                            // Conditions can't be pushed into a WHERE on insert, so
+                                            // validate the incoming data satisfies them before insert.
+                                            await this.enforceCreateConditions(String(propKey), userRole, params, user, methodKey.toString());
+                                        }
+                                        else {
+                                            params = this.applyWhereConditions(String(propKey), userRole, params, user, methodKey);
+                                        }
                                     }
                                     else {
                                         this.debug(`Skipping permission filtering for ${String(propKey)}.${String(methodKey)}()`);
@@ -95,7 +106,14 @@ let PrismaService = exports.PrismaService = PrismaService_1 = class PrismaServic
                                         delete params.select;
                                     }
                                     this.debug(`Executing ${String(propKey)}.${String(methodKey)}() with params: ${JSON.stringify(params)}`);
-                                    return contextModel[methodKey](params);
+                                    const result = await contextModel[methodKey](params);
+                                    // Dev-only: warn if a just-created row wouldn't be readable by its
+                                    // creator (create conditions broader than find conditions). Skipped
+                                    // outside development so no extra query runs on the hot path.
+                                    if (methodKey === 'create' && !options?.BYPASS_FILTERING && this.isDevMode()) {
+                                        await this.warnIfCreatedRowNotFindable(String(propKey), userRole, result);
+                                    }
+                                    return result;
                                 };
                             }
                             return model[methodKey];
@@ -380,6 +398,193 @@ let PrismaService = exports.PrismaService = PrismaService_1 = class PrismaServic
         }
         return args;
     }
+    /**
+     * Enforces permission `conditions` on `create` / `createMany`.
+     *
+     * Conditions cannot be pushed into a `WHERE` on insert, so instead we verify
+     * the incoming data *would* satisfy them — i.e. a `findFirst` with those
+     * conditions would return the new row. Own-scalar fields are checked against
+     * `data`; relation conditions are checked by looking up the referenced parent
+     * (which lets Prisma evaluate arbitrarily-nested relation conditions for us).
+     *
+     * Also default-denies: create is only allowed for a role/action that has an
+     * explicit permission (or 'ALL'), mirroring find/update/delete. Framework
+     * flows that must create without a permission (registration, sessions,
+     * tokens) pass BYPASS_FILTERING and never reach here.
+     *
+     * Fails **closed**: throws on a violation and on any condition shape it
+     * cannot evaluate, rather than silently allowing the insert.
+     */
+    async enforceCreateConditions(modelName, userRole, params, user, action) {
+        const normalizedName = modelName.toLowerCase().trim();
+        const exposedModels = (exports.CorePrismaContext.getStore()?.exposedModels || []).map((m) => m.toLowerCase());
+        if (exposedModels.includes(normalizedName))
+            return;
+        const permissions = this.normalizedPermissionsConfig[normalizedName]?.[userRole];
+        if (!permissions) {
+            throw new common_1.HttpException(`No permissions defined for role ${userRole} on model '${modelName}' — create is denied by default. Define a '${action}' permission (or 'ALL').`, common_1.HttpStatus.FORBIDDEN);
+        }
+        const actionPermissions = permissions[action] ?? permissions['create'];
+        if (!actionPermissions) {
+            throw new common_1.HttpException(`Role ${userRole} has no '${action}' permission on model '${modelName}' — create is denied. Define it (or 'ALL').`, common_1.HttpStatus.FORBIDDEN);
+        }
+        if (actionPermissions === 'ALL')
+            return;
+        const conditions = actionPermissions.conditions;
+        if (!conditions)
+            return; // permission defined but no conditions (e.g. setUserIdField only) → allow
+        const condObj = Array.isArray(conditions) ? { AND: conditions } : conditions;
+        const resolved = PrismaService_1._buildConditions(condObj, user);
+        const data = params?.data;
+        const rows = Array.isArray(data) ? data : [data ?? {}];
+        for (const row of rows) {
+            const ok = await this.matchesCreateConditions(resolved, row || {}, modelName);
+            if (!ok) {
+                throw new common_1.ForbiddenException(`Not allowed to create ${modelName}: the record does not satisfy the '${action}' permission conditions for role ${userRole}.`);
+            }
+        }
+    }
+    /**
+     * True only in an explicit local-development environment. Deliberately NOT
+     * `!== 'production'` — staging and other envs should behave like production
+     * (no extra diagnostic queries/logging). Only `development` / `dev` opt in.
+     */
+    isDevMode() {
+        const env = process.env.NODE_ENV;
+        return env === 'development' || env === 'dev';
+    }
+    /**
+     * Dev-only diagnostic. After a create that passed its create-conditions,
+     * checks whether the new row also satisfies the model's *find* conditions —
+     * if not, the creator can't read it back (create rule broader than find
+     * rule). Logs a warning; never affects the create. Runs only in development
+     * (gated by the caller).
+     */
+    async warnIfCreatedRowNotFindable(modelKey, userRole, created) {
+        try {
+            if (!created || created.id === undefined || created.id === null)
+                return;
+            const permissions = this.normalizedPermissionsConfig[modelKey.toLowerCase()]?.[userRole];
+            const findPerm = permissions?.['findFirst'] ?? permissions?.['findMany'];
+            if (!findPerm || findPerm === 'ALL' || !findPerm.conditions)
+                return;
+            const found = await this.prismaClient[modelKey].findFirst({ where: { id: created.id } });
+            if (!found) {
+                console.warn('\x1b[33m', `[APPX-CORE PRISMA] Created ${modelKey} id=${created.id} as role ${userRole}, but it does not satisfy the model's find conditions — the creator cannot read it back. Ensure your find conditions are at least as permissive as your create conditions.`, '\x1b[0m');
+            }
+        }
+        catch {
+            // Dev diagnostic only — never let it affect the create.
+        }
+    }
+    /** Recursively evaluates a (placeholder-resolved) condition object against a to-be-created row. */
+    async matchesCreateConditions(cond, row, modelName) {
+        for (const key of Object.keys(cond)) {
+            const val = cond[key];
+            if (key === 'AND') {
+                const arr = Array.isArray(val) ? val : [val];
+                for (const c of arr)
+                    if (!(await this.matchesCreateConditions(c, row, modelName)))
+                        return false;
+                continue;
+            }
+            if (key === 'OR') {
+                const arr = Array.isArray(val) ? val : [val];
+                let any = false;
+                for (const c of arr)
+                    if (await this.matchesCreateConditions(c, row, modelName)) {
+                        any = true;
+                        break;
+                    }
+                if (!any)
+                    return false;
+                continue;
+            }
+            if (key === 'NOT') {
+                const arr = Array.isArray(val) ? val : [val];
+                for (const c of arr)
+                    if (await this.matchesCreateConditions(c, row, modelName))
+                        return false;
+                continue;
+            }
+            const relation = this.getRelation(modelName, key);
+            if (relation) {
+                if (!(await this.matchesCreateRelation(relation, key, val, row, modelName)))
+                    return false;
+                continue;
+            }
+            if (!this.matchesCreateScalar(row[key], val, key, modelName))
+                return false;
+        }
+        return true;
+    }
+    /** Evaluates a scalar-field condition (value or Prisma operator object) against the row's value. */
+    matchesCreateScalar(actual, cond, key, modelName) {
+        if (cond === null)
+            return actual === null || actual === undefined;
+        if (cond instanceof Date || typeof cond !== 'object')
+            return actual === cond;
+        for (const op of Object.keys(cond)) {
+            const opv = cond[op];
+            switch (op) {
+                case 'equals':
+                    if (actual !== opv)
+                        return false;
+                    break;
+                case 'not':
+                    if (actual === opv)
+                        return false;
+                    break;
+                case 'in':
+                    if (!Array.isArray(opv) || !opv.includes(actual))
+                        return false;
+                    break;
+                case 'notIn':
+                    if (Array.isArray(opv) && opv.includes(actual))
+                        return false;
+                    break;
+                case 'lt':
+                    if (!(actual < opv))
+                        return false;
+                    break;
+                case 'lte':
+                    if (!(actual <= opv))
+                        return false;
+                    break;
+                case 'gt':
+                    if (!(actual > opv))
+                        return false;
+                    break;
+                case 'gte':
+                    if (!(actual >= opv))
+                        return false;
+                    break;
+                default:
+                    throw new common_1.ForbiddenException(`create on ${modelName}: unsupported operator '${op}' on field '${key}' in a create condition. Use a simpler condition or setUserIdField.`);
+            }
+        }
+        return true;
+    }
+    /** Verifies the parent referenced by a belongsTo condition exists and satisfies the nested condition. */
+    async matchesCreateRelation(relation, field, nestedCond, row, modelName) {
+        if (relation.relation !== 'belongsTo' || !relation.referencingColumn) {
+            throw new common_1.ForbiddenException(`create on ${modelName}: unsupported relation condition on '${field}' — a new row has no related '${field}' yet to match. Constrain the scalar foreign key instead.`);
+        }
+        const fkValue = row[relation.referencingColumn];
+        if (fkValue === undefined || fkValue === null)
+            return false;
+        const delegate = relation.model.charAt(0).toLowerCase() + relation.model.slice(1);
+        // Use the request's transaction client if present (to see rows created
+        // earlier in the same request), else the raw client. Either way, access
+        // filtering on the parent is intentionally NOT re-applied — we check
+        // only the condition.
+        const client = nestjs_request_context_1.RequestContext.currentContext?.req.prisma || this.rawClient;
+        const found = await client[delegate].findFirst({
+            where: { AND: [{ [relation.foreignKey]: fkValue }, nestedCond] },
+            select: { [relation.foreignKey]: true },
+        });
+        return !!found;
+    }
     /**
      * Builds dynamic conditions based on the type of clause (OR, AND, or field conditions).
      * Each condition is processed, and placeholders (like `$USER_ID`) are replaced with actual values.