@appxdigital/appx-core 0.1.128-beta.2 → 0.1.128-beta.4

package/CHANGELOG.md

@@ -29,6 +29,12 @@ Read-only GraphQL, reworked into a **namespaced, opt-in-per-module** API.
 - **Nested selection is to-one only.** Generated GraphQL model types expose scalars, **to-one** relations, and `_count`; **to-many relations are not nested-selectable** (nested lists have no pagination, so they could return unbounded rows). Fetch a list at the top level with pagination — `track { find(where: { albumId … }, take, skip) }`. Filtering by a to-many relation in `where` (`some`/`every`/`none`) and `_count { … }` still work.
 - **Self-documenting operations.** `find` / `get` / `count` and their `where` arg carry GraphQL descriptions (visible in the Apollo Sandbox); model-field descriptions come from Prisma `///` doc comments as before. See [docs/graphql.md](./docs/graphql.md) for the full `where`/`orderBy`/pagination reference.
 - **Malformed filter values return `400`, not `500`.** A `where`/`orderBy` value Prisma can't parse (e.g. `createdAt: { gt: 2024 }` — a number where a date is expected) now surfaces a clean `400`, instead of an internal error that leaked the raw Prisma invocation.
+- **Output shaping via native field resolvers.** Transform a field on the way out (sign a stored key into a URL, mask, format) or add a computed field with a `@Resolver(() => Model)` + `@ResolveField`, registered in the module. A field resolver reads its source columns from `@Parent()`; ABAC field omission still runs at query time, so a transform never sees a `@Role`-restricted column. New **`@FieldRequires('col')`** (one column, several, or an array) declares which columns a computed field reads so the generated `find`/`get` fetches exactly those; undeclared computed fields fall back to fetching all scalar columns, and relations always stay selection-driven. See [docs/graphql.md](./docs/graphql.md) → *Shaping read output*.
+- **GraphQL introspection on in development.** The Apollo Sandbox (`GET /graphql`) needs introspection, which Apollo Server v4 disables under `NODE_ENV=production` (`INTROSPECTION_DISABLED`). It is now enabled in development and disabled in production by default (defense-in-depth — introspection exposes schema shape, not data, which ABAC still governs). Opt in for a production deployment with `APPX_GRAPHQL_INTROSPECTION=true`.
+
+### Fixed
+
+- **Compound-name models now work over GraphQL.** `getModelDelegate` lowercased the whole model name (`AlbumMember` → `albummember`) instead of just the first character, so it missed Prisma's camelCase delegate key (`albumMember`) and every `find`/`get`/`count` on a model with an internal capital threw `Model <X> not found in PrismaClient.`. Single-word models (`Album`) worked only by coincidence. It now lowercases only the first character, matching Prisma's delegate naming (and the resolver's own root-name rule). REST was never affected. Regression covered by a compound-name model (`ProjectMember`) in `test/http/graphql-abac.spec.ts`.
 
 ### Changed / Removed
 

package/dist/common/decorators/field-requires.decorator.d.ts

@@ -0,0 +1,50 @@
+/**
+ * The GraphQL schema-field `extensions` key under which {@link FieldRequires}
+ * records the source columns. The generated read resolver reads it back from the
+ * schema when deciding which columns to fetch
+ * (see `generic.resolver.ts` → `selectReadColumns`).
+ */
+export declare const FIELD_REQUIRES_EXTENSION = "requires";
+/**
+ * Declare the model columns a custom GraphQL `@ResolveField` reads from its
+ * `@Parent()`, so the generated `find` / `get` fetches those columns even when
+ * the client didn't select them.
+ *
+ * Use it on a computed field whose value derives from a column — e.g. a signed
+ * `coverUrl` built from a stored `coverKey`. Without it, only the columns the
+ * client selected are fetched and `@Parent().coverKey` would be `undefined`.
+ *
+ * - Declared → only the listed columns are fetched for the field.
+ * - Not declared → all of the model's scalar columns are fetched.
+ * - Not needed for an in-place transform that reuses an existing field's name.
+ *
+ * ABAC applies: a column the caller's role may not read is omitted at query time,
+ * so the resolver sees it as absent — a transform can never surface a
+ * `@Role`-restricted value.
+ *
+ * Accepts a single column, several columns, or an array.
+ *
+ * @param columns - The scalar column name(s) the resolver reads from its parent.
+ *
+ * @example
+ * ```ts
+ * @Resolver(() => Project)
+ * export class ProjectFields {
+ *   constructor(private readonly urls: UrlSigner) {}
+ *
+ *   @ResolveField(() => String, { nullable: true })
+ *   @FieldRequires('coverKey')
+ *   coverUrl(@Parent() p: Project) {
+ *     return p.coverKey ? this.urls.sign(p.coverKey) : null;
+ *   }
+ *
+ *   @ResolveField(() => String, { nullable: true })
+ *   @FieldRequires(['firstName', 'lastName'])
+ *   fullName(@Parent() p: Project) {
+ *     return [p.firstName, p.lastName].filter(Boolean).join(' ') || null;
+ *   }
+ * }
+ * ```
+ */
+export declare const FieldRequires: (...columns: (string | string[])[]) => MethodDecorator & ClassDecorator & PropertyDecorator;
+//# sourceMappingURL=field-requires.decorator.d.ts.map

package/dist/common/decorators/field-requires.decorator.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"field-requires.decorator.d.ts","sourceRoot":"","sources":["../../../src/common/decorators/field-requires.decorator.ts"],"names":[],"mappings":"AAEA;;;;;GAKG;AACH,eAAO,MAAM,wBAAwB,aAAa,CAAC;AAEnD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AACH,eAAO,MAAM,aAAa,eAAgB,CAAC,MAAM,GAAG,MAAM,EAAE,CAAC,EAAE,yDACH,CAAC"}

package/dist/common/decorators/field-requires.decorator.js

@@ -0,0 +1,54 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.FieldRequires = exports.FIELD_REQUIRES_EXTENSION = void 0;
+const graphql_1 = require("@nestjs/graphql");
+/**
+ * The GraphQL schema-field `extensions` key under which {@link FieldRequires}
+ * records the source columns. The generated read resolver reads it back from the
+ * schema when deciding which columns to fetch
+ * (see `generic.resolver.ts` → `selectReadColumns`).
+ */
+exports.FIELD_REQUIRES_EXTENSION = 'requires';
+/**
+ * Declare the model columns a custom GraphQL `@ResolveField` reads from its
+ * `@Parent()`, so the generated `find` / `get` fetches those columns even when
+ * the client didn't select them.
+ *
+ * Use it on a computed field whose value derives from a column — e.g. a signed
+ * `coverUrl` built from a stored `coverKey`. Without it, only the columns the
+ * client selected are fetched and `@Parent().coverKey` would be `undefined`.
+ *
+ * - Declared → only the listed columns are fetched for the field.
+ * - Not declared → all of the model's scalar columns are fetched.
+ * - Not needed for an in-place transform that reuses an existing field's name.
+ *
+ * ABAC applies: a column the caller's role may not read is omitted at query time,
+ * so the resolver sees it as absent — a transform can never surface a
+ * `@Role`-restricted value.
+ *
+ * Accepts a single column, several columns, or an array.
+ *
+ * @param columns - The scalar column name(s) the resolver reads from its parent.
+ *
+ * @example
+ * ```ts
+ * @Resolver(() => Project)
+ * export class ProjectFields {
+ *   constructor(private readonly urls: UrlSigner) {}
+ *
+ *   @ResolveField(() => String, { nullable: true })
+ *   @FieldRequires('coverKey')
+ *   coverUrl(@Parent() p: Project) {
+ *     return p.coverKey ? this.urls.sign(p.coverKey) : null;
+ *   }
+ *
+ *   @ResolveField(() => String, { nullable: true })
+ *   @FieldRequires(['firstName', 'lastName'])
+ *   fullName(@Parent() p: Project) {
+ *     return [p.firstName, p.lastName].filter(Boolean).join(' ') || null;
+ *   }
+ * }
+ * ```
+ */
+const FieldRequires = (...columns) => (0, graphql_1.Extensions)({ [exports.FIELD_REQUIRES_EXTENSION]: columns.flat() });
+exports.FieldRequires = FieldRequires;

package/dist/graphql/generic.resolver.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"generic.resolver.d.ts","sourceRoot":"","sources":["../../src/graphql/generic.resolver.ts"],"names":[],"mappings":"AAEA,OAAO,EAAC,IAAI,EAAC,MAAM,iBAAiB,CAAC;AAwBrC;;;;GAIG;AACH,MAAM,WAAW,kBAAkB,CAAC,SAAS,GAAG,GAAG;IAC/C,iFAAiF;IACjF,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;IACvB,gFAAgF;IAChF,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,oDAAoD;IACpD,YAAY,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC;IACxB,oDAAoD;IACpD,aAAa,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC;IACzB,8DAA8D;IAC9D,UAAU,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC;CACzB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,wBAAgB,mBAAmB,CAAC,SAAS,EAAE,MAAM,EAAE,kBAAkB,CAAC,SAAS,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,CAuE/F"}
+{"version":3,"file":"generic.resolver.d.ts","sourceRoot":"","sources":["../../src/graphql/generic.resolver.ts"],"names":[],"mappings":"AAEA,OAAO,EAAC,IAAI,EAAC,MAAM,iBAAiB,CAAC;AA4GrC;;;;GAIG;AACH,MAAM,WAAW,kBAAkB,CAAC,SAAS,GAAG,GAAG;IAC/C,iFAAiF;IACjF,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;IACvB,gFAAgF;IAChF,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,oDAAoD;IACpD,YAAY,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC;IACxB,oDAAoD;IACpD,aAAa,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC;IACzB,8DAA8D;IAC9D,UAAU,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC;CACzB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,wBAAgB,mBAAmB,CAAC,SAAS,EAAE,MAAM,EAAE,kBAAkB,CAAC,SAAS,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,CAuE/F"}

package/dist/graphql/generic.resolver.js

@@ -16,7 +16,9 @@ exports.CoreGraphqlResolver = void 0;
 const graphql_1 = require("@nestjs/graphql");
 const common_1 = require("@nestjs/common");
 const plugins_1 = require("@paljs/plugins");
+const graphql_2 = require("graphql");
 const prisma_service_1 = require("../prisma/prisma.service");
+const field_requires_decorator_1 = require("../common/decorators/field-requires.decorator");
 /**
  * Run a read and translate a Prisma **validation** error into a `400`. A
  * malformed `where`/`orderBy` value (e.g. `createdAt: { gt: 2024 }` — a number
@@ -36,6 +38,85 @@ async function readOrBadRequest(op) {
         throw e;
     }
 }
+/**
+ * Turn a `PrismaSelect`-derived selection into the columns actually fetched,
+ * resolving the source columns that custom `@ResolveField`s need.
+ *
+ * `PrismaSelect` narrows the Prisma query to exactly the fields the GraphQL
+ * request asked for. That breaks the standard NestJS code-first contract where a
+ * `@ResolveField` on the model type receives the full entity as `@Parent()`: a
+ * custom field (`coverUrl` derived from a `coverKey` column, or a signed-URL
+ * transform of an existing field) can't read a source column the client didn't
+ * also select. We restore that contract with a **hybrid** strategy that avoids
+ * over-fetching:
+ *
+ *   - A custom field can declare its source columns natively, via the standard
+ *     NestJS field `extensions`:
+ *         `@ResolveField(() => String, { extensions: { requires: ['coverKey'] } })`
+ *     When declared, ONLY those columns are added — no over-fetch.
+ *   - A custom field that declares nothing falls back to fetching all of the
+ *     model's scalar columns (safe default: the resolver can read anything from
+ *     `@Parent()`), at the cost of reading columns the query didn't select.
+ *   - A query that selects no custom fields fetches exactly what was asked for.
+ *
+ * Relations stay selection-driven throughout (no unbounded relation fetching).
+ * ABAC field omission runs afterward in the proxy and strips `@Role`-restricted
+ * columns at select-time, so a caller still only ever receives — and a transform
+ * only ever sees — the columns their role may read.
+ *
+ * Custom field names (no backing column) are dropped from the Prisma `select`:
+ * `PrismaSelect` puts every requested GraphQL field there, and passing a name
+ * Prisma doesn't recognise throws a validation error. They resolve from the
+ * parent afterward, so they must not reach the query.
+ */
+function selectReadColumns(select, info, prisma, modelName) {
+    const scalars = new Set(prisma.getScalarFields(modelName));
+    const requested = select?.select && typeof select.select === 'object' ? select.select : {};
+    // The GraphQL type of the returned rows, to read each field's
+    // `extensions.requires` (find → [Model], get → Model; getNamedType unwraps).
+    const named = (0, graphql_2.getNamedType)(info.returnType);
+    const gqlFields = named instanceof graphql_2.GraphQLObjectType ? named.getFields() : {};
+    const out = {};
+    const requiredColumns = new Set();
+    let needAllScalars = false;
+    for (const [key, value] of Object.entries(requested)) {
+        if (value && typeof value === 'object') {
+            out[key] = value; // a relation (or `_count`) selection — keep as-is
+        }
+        else if (scalars.has(key)) {
+            out[key] = value; // a real scalar column
+        }
+        else {
+            // A custom field resolver (no backing column). Prefer its declared
+            // dependencies (@FieldRequires); otherwise fall back to all scalars.
+            const requires = gqlFields[key]?.extensions?.[field_requires_decorator_1.FIELD_REQUIRES_EXTENSION];
+            if (Array.isArray(requires)) {
+                for (const col of requires) {
+                    if (scalars.has(col))
+                        requiredColumns.add(col);
+                }
+            }
+            else {
+                needAllScalars = true;
+            }
+        }
+    }
+    if (needAllScalars) {
+        for (const field of scalars)
+            out[field] = true;
+    }
+    else {
+        for (const col of requiredColumns)
+            out[col] = true;
+    }
+    // Guard against an empty select (e.g. only a custom field with `requires: []`)
+    // — an empty Prisma `select` is invalid; fall back to all scalars.
+    if (Object.keys(out).length === 0) {
+        for (const field of scalars)
+            out[field] = true;
+    }
+    return { ...(select && typeof select === 'object' ? select : {}), select: out };
+}
 /**
  * Build a **namespaced, read-only** GraphQL resolver for one model.
  *
@@ -87,11 +168,11 @@ function CoreGraphqlResolver(bundle) {
             return {};
         }
         async find(args, info) {
-            const select = new plugins_1.PrismaSelect(info).value;
+            const select = selectReadColumns(new plugins_1.PrismaSelect(info).value, info, this.prisma, modelName);
             return readOrBadRequest(() => this.prisma.getModelDelegate(modelName).findMany({ ...args, ...select }));
         }
         async get(args, info) {
-            const select = new plugins_1.PrismaSelect(info).value;
+            const select = selectReadColumns(new plugins_1.PrismaSelect(info).value, info, this.prisma, modelName);
             return readOrBadRequest(() => this.prisma.getModelDelegate(modelName).findFirst({ ...args, ...select }));
         }
         async count(where) {

package/dist/graphql/graphql.module.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"graphql.module.d.ts","sourceRoot":"","sources":["../../src/graphql/graphql.module.ts"],"names":[],"mappings":"AAKA;;;;;GAKG;AACH,qBACa,oBAAoB;IAK7B,QAAQ,IAAI,MAAM;CAGrB;AAED,qBAca,aAAa;CAAG"}
+{"version":3,"file":"graphql.module.d.ts","sourceRoot":"","sources":["../../src/graphql/graphql.module.ts"],"names":[],"mappings":"AAKA;;;;;GAKG;AACH,qBACa,oBAAoB;IAK7B,QAAQ,IAAI,MAAM;CAGrB;AAED,qBAwBa,aAAa;CAAG"}

package/dist/graphql/graphql.module.js

@@ -49,6 +49,15 @@ exports.GraphqlModule = GraphqlModule = __decorate([
                 // `src/generated/` path at boot (CI, read-only deploys, tests).
                 autoSchemaFile: true,
                 sortSchema: true,
+                // Introspection powers the Apollo Sandbox (GET /graphql). It exposes
+                // the schema shape (not data — ABAC still governs every field), so we
+                // keep it ON in development for the Sandbox, and OFF in production as
+                // defense-in-depth (less recon surface). Opt back in for a production
+                // deployment with APPX_GRAPHQL_INTROSPECTION=true. Without this, Apollo
+                // Server v4 disables introspection under NODE_ENV=production and the
+                // Sandbox fails with `INTROSPECTION_DISABLED`.
+                introspection: process.env.NODE_ENV !== 'production' ||
+                    process.env.APPX_GRAPHQL_INTROSPECTION === 'true',
             }),
         ],
         providers: [AppxCoreRootResolver],

package/dist/index.d.ts

@@ -37,6 +37,7 @@ export * from './common/interfaces/storage-service.interface';
 export * from './modules/file/file-upload.controller';
 export * from './modules/file/file-upload.service';
 export * from './common/decorators/permission.decorator';
+export * from './common/decorators/field-requires.decorator';
 export * from './common/setup/setup-core-security';
 export * from './common/setup/core-config';
 export * from './common/interceptors/file.interceptor';

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,4BAA4B,CAAC;AAC3C,cAAc,6BAA6B,CAAC;AAC5C,cAAc,gCAAgC,CAAC;AAC/C,cAAc,yBAAyB,CAAC;AACxC,cAAc,0BAA0B,CAAC;AACzC,cAAc,4BAA4B,CAAC;AAC3C,cAAc,iCAAiC,CAAC;AAChD,cAAc,4BAA4B,CAAC;AAI3C,cAAc,gCAAgC,CAAC;AAC/C,cAAc,6BAA6B,CAAC;AAC5C,cAAc,iCAAiC,CAAC;AAChD,cAAc,6BAA6B,CAAC;AAC5C,cAAc,qCAAqC,CAAC;AACpD,cAAc,+BAA+B,CAAC;AAC9C,cAAc,iCAAiC,CAAC;AAChD,cAAc,6BAA6B,CAAC;AAC5C,cAAc,uCAAuC,CAAC;AACtD,cAAc,oCAAoC,CAAC;AACnD,cAAc,2CAA2C,CAAC;AAC1D,cAAc,2CAA2C,CAAC;AAC1D,cAAc,sCAAsC,CAAC;AACrD,cAAc,4BAA4B,CAAC;AAC3C,cAAc,uCAAuC,CAAC;AACtD,cAAc,yBAAyB,CAAC;AACxC,cAAc,0CAA0C,CAAC;AACzD,cAAc,4CAA4C,CAAC;AAC3D,cAAc,+BAA+B,CAAC;AAC9C,cAAc,oCAAoC,CAAC;AACnD,cAAc,wCAAwC,CAAC;AACvD,cAAc,iCAAiC,CAAC;AAChD,cAAc,6CAA6C,CAAC;AAC5D,cAAc,oBAAoB,CAAC;AACnC,cAAc,mCAAmC,CAAC;AAClD,cAAc,2CAA2C,CAAC;AAC1D,cAAc,wCAAwC,CAAC;AACvD,cAAc,+CAA+C,CAAC;AAC9D,cAAc,uCAAuC,CAAC;AACtD,cAAc,oCAAoC,CAAC;AACnD,cAAc,0CAA0C,CAAC;AACzD,cAAc,oCAAoC,CAAC;AACnD,cAAc,4BAA4B,CAAC;AAC3C,cAAc,wCAAwC,CAAC;AACvD,cAAc,oCAAoC,CAAC;AACnD,cAAc,+BAA+B,CAAC;AAC9C,cAAc,qCAAqC,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,4BAA4B,CAAC;AAC3C,cAAc,6BAA6B,CAAC;AAC5C,cAAc,gCAAgC,CAAC;AAC/C,cAAc,yBAAyB,CAAC;AACxC,cAAc,0BAA0B,CAAC;AACzC,cAAc,4BAA4B,CAAC;AAC3C,cAAc,iCAAiC,CAAC;AAChD,cAAc,4BAA4B,CAAC;AAI3C,cAAc,gCAAgC,CAAC;AAC/C,cAAc,6BAA6B,CAAC;AAC5C,cAAc,iCAAiC,CAAC;AAChD,cAAc,6BAA6B,CAAC;AAC5C,cAAc,qCAAqC,CAAC;AACpD,cAAc,+BAA+B,CAAC;AAC9C,cAAc,iCAAiC,CAAC;AAChD,cAAc,6BAA6B,CAAC;AAC5C,cAAc,uCAAuC,CAAC;AACtD,cAAc,oCAAoC,CAAC;AACnD,cAAc,2CAA2C,CAAC;AAC1D,cAAc,2CAA2C,CAAC;AAC1D,cAAc,sCAAsC,CAAC;AACrD,cAAc,4BAA4B,CAAC;AAC3C,cAAc,uCAAuC,CAAC;AACtD,cAAc,yBAAyB,CAAC;AACxC,cAAc,0CAA0C,CAAC;AACzD,cAAc,4CAA4C,CAAC;AAC3D,cAAc,+BAA+B,CAAC;AAC9C,cAAc,oCAAoC,CAAC;AACnD,cAAc,wCAAwC,CAAC;AACvD,cAAc,iCAAiC,CAAC;AAChD,cAAc,6CAA6C,CAAC;AAC5D,cAAc,oBAAoB,CAAC;AACnC,cAAc,mCAAmC,CAAC;AAClD,cAAc,2CAA2C,CAAC;AAC1D,cAAc,wCAAwC,CAAC;AACvD,cAAc,+CAA+C,CAAC;AAC9D,cAAc,uCAAuC,CAAC;AACtD,cAAc,oCAAoC,CAAC;AACnD,cAAc,0CAA0C,CAAC;AACzD,cAAc,8CAA8C,CAAC;AAC7D,cAAc,oCAAoC,CAAC;AACnD,cAAc,4BAA4B,CAAC;AAC3C,cAAc,wCAAwC,CAAC;AACvD,cAAc,oCAAoC,CAAC;AACnD,cAAc,+BAA+B,CAAC;AAC9C,cAAc,qCAAqC,CAAC"}

package/dist/index.js

@@ -56,6 +56,7 @@ __exportStar(require("./common/interfaces/storage-service.interface"), exports);
 __exportStar(require("./modules/file/file-upload.controller"), exports);
 __exportStar(require("./modules/file/file-upload.service"), exports);
 __exportStar(require("./common/decorators/permission.decorator"), exports);
+__exportStar(require("./common/decorators/field-requires.decorator"), exports);
 __exportStar(require("./common/setup/setup-core-security"), exports);
 __exportStar(require("./common/setup/core-config"), exports);
 __exportStar(require("./common/interceptors/file.interceptor"), exports);

package/dist/prisma/prisma.service.d.ts

@@ -229,6 +229,21 @@ export declare class PrismaService {
      * @returns The condition with placeholders replaced by actual values.
      */
     private static replacePlaceholders;
+    /**
+     * The scalar (and enum) field names of a model, as derived from the Prisma
+     * DMMF at bootstrap. Relations are excluded.
+     *
+     * Used by the GraphQL generic resolver to fetch the model's own columns even
+     * when a query only selects a subset, so that a custom `@ResolveField` on the
+     * model type (e.g. a signed-URL transform) can read its source column from
+     * `@Parent()`. ABAC field omission still runs afterward at select-time, so a
+     * `@Role`-restricted column is never actually fetched — callers only ever get
+     * the readable projection.
+     *
+     * @param modelName - The model name (any casing; matched case-insensitively).
+     * @returns The model's scalar field names, or `[]` if the model is unknown.
+     */
+    getScalarFields(modelName: string): string[];
     /**
      * Retrieves the list of fields to omit based on the user's role.
      * It checks the field configurations stored in `fieldConfigs` and compares them against the role.

package/dist/prisma/prisma.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"prisma.service.d.ts","sourceRoot":"","sources":["../../src/prisma/prisma.service.ts"],"names":[],"mappings":";AACA,OAAO,EAAC,MAAM,EAAE,YAAY,EAAC,MAAM,gBAAgB,CAAC;AACpD,OAAO,EAAC,qBAAqB,EAAkB,MAAM,yCAAyC,CAAC;AAG/F,OAAO,KAAK,EAAC,YAAY,IAAI,aAAa,EAAC,MAAM,gBAAgB,CAAC;AAGlE,OAAO,EAAC,iBAAiB,EAAC,MAAM,kBAAkB,CAAC;AAEnD,eAAO,MAAM,iBAAiB;mBACX,MAAM,EAAE;EACvB,CAAC;AAEL,KAAK,QAAQ,GAAG,MAAM,aAAa,CAAC;AAEpC,oDAAoD;AACpD,MAAM,MAAM,iBAAiB,GAAG;IAC5B,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,gBAAgB,CAAC,EAAE,OAAO,CAAC;CAC9B,CAAC;AAEF,4EAA4E;AAC5E,KAAK,QAAQ,CAAC,CAAC,EAAE,CAAC,SAAS,MAAM,IAAI,CAAC,SAAS,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC;AAEtE;;;;;;;;;GASG;AACH,MAAM,MAAM,eAAe,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,EAAE,YAAY,GAAG,mBAAmB,GAAG,QAAQ,GAAG,QAAQ,CAAC,GAAG;IACjG,UAAU,EAAE,QAAQ,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC;IACrC,iBAAiB,EAAE,QAAQ,CAAC,CAAC,EAAE,kBAAkB,CAAC,CAAC;IACnD,MAAM,EAAE,QAAQ,CAAC,CAAC,EAAE,YAAY,CAAC,CAAC;IAClC,MAAM,EAAE,QAAQ,CAAC,CAAC,EAAE,YAAY,CAAC,CAAC;CACrC,CAAC;AAGF,MAAM,MAAM,eAAe,CAAC,CAAC,SAAS,QAAQ,IAAI,eAAe,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC;AAEpF;;;GAGG;AACH,MAAM,MAAM,gBAAgB,CAAC,CAAC,IAAI;KAC7B,CAAC,IAAI,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS;QAAE,QAAQ,EAAE,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,KAAK,GAAG,CAAA;KAAE,GAAG,eAAe,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;CACpG,CAAC;AAEF,qBACa,aAAa;IAaY,OAAO,CAAC,QAAQ,CAAC,iBAAiB;IAZpE,OAAO,CAAC,YAAY,CAA2B;IAC/C,YAAY,EAAE,YAAY,CAAC;IAC3B;;;;;OAKG;IACH,OAAO,CAAC,SAAS,CAAgB;gBAG7B,YAAY,EAAE,YAAY,EACqB,iBAAiB,EAAE,qBAAqB;IAQ3F;;;;;OAKG;IACH,OAAO,CAAC,mBAAmB;IA6B3B,YAAY,CAAC,MAAM,EAAE,OAAO;IAO5B,iBAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC;IAWjE,OAAO,CAAC,KAAK;IAQb,YAAY,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,iBAAiB,KAAK,OAAO,CAAC,CAAC,CAAC;IAIpE,WAAW;IAuFX;;;;OAIG;IACH,gBAAgB,CAAC,CAAC,SAAS,QAAQ,EAAE,KAAK,EAAE,CAAC,GAAG,eAAe,CAAC,CAAC,CAAC;IAYlE,IAAI,KAAK,IAAI,gBAAgB,CAAC,aAAa,CAAC,CAU3C;IAED,IAAI,IAAI,IAAI,eAAe,CAAC,MAAM,CAAC,CAElC;IAED,IAAI,OAAO,IAAI,eAAe,CAAC,SAAS,CAAC,CAExC;IAED,IAAI,gBAAgB,QAEnB;IAED;;;OAGG;IACH,WAAW;IA+DX;;;;;;;;OAQG;IACH,OAAO,CAAC,kBAAkB;IAkE1B,IAAI,2BAA2B,QAM9B;IAED;;;;;;;;;;;OAWG;IACH;;;;;;;OAOG;IACH,OAAO,CAAC,0BAA0B;IAYlC,mFAAmF;IACnF,OAAO,CAAC,0BAA0B;IAgDlC;;;;;;OAMG;IACH,OAAO,CAAC,uBAAuB;IAQ/B,OAAO,CAAC,0BAA0B;IAOlC,OAAO,CAAC,oBAAoB;IA8K5B;;;;;;;;;;;;;;;;OAgBG;YACW,uBAAuB;IAkDrC;;;;;;;;;;;;;;;;;;;OAmBG;YACW,mBAAmB;IA2BjC,0EAA0E;YAC5D,wBAAwB;IAmCtC,yGAAyG;IACzG,OAAO,CAAC,gBAAgB;IAWxB,4FAA4F;IAC5F,OAAO,CAAC,eAAe;IAcvB;;;;;;;;OAQG;YACW,oBAAoB;IA6ClC;;;;OAIG;IACH,OAAO,CAAC,SAAS;IAKjB;;;;;;OAMG;YACW,2BAA2B;IAqBzC;;;;;;OAMG;IACH,OAAO,CAAC,yBAAyB;IAmBjC;;;;;;;OAOG;YACW,uBAAuB;IA8BrC,oGAAoG;IACpG,OAAO,CAAC,mBAAmB;IAwB3B;;;;;;;OAOG;WACW,gBAAgB,CAAC,UAAU,EAAE,GAAG,EAAE,EAAE,IAAI,EAAE,GAAG,GAAG,GAAG;IAgBjE;;;;;;;OAOG;IACH,OAAO,CAAC,MAAM,CAAC,mBAAmB;IA2BlC;;;;;;;OAOG;IACH,OAAO,CAAC,eAAe;IAUvB;;;;;;;;;;OAUG;IACH,OAAO,CAAC,iBAAiB;IA8EzB,WAAW,CAAC,WAAW,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,eAAe,CAAC,EAAE,IAAI,GAAG;QAC5E,KAAK,EAAE,MAAM,CAAC;QACd,QAAQ,EAAE,MAAM,CAAC;QACjB,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,iBAAiB,CAAC,EAAE,MAAM,CAAC;QAC3B,YAAY,CAAC,EAAE,MAAM,CAAC;QACtB,UAAU,EAAE,OAAO,CAAA;KACtB;IAoBD,gBAAgB,CAAC,WAAW,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM;CAyBzF"}
+{"version":3,"file":"prisma.service.d.ts","sourceRoot":"","sources":["../../src/prisma/prisma.service.ts"],"names":[],"mappings":";AACA,OAAO,EAAC,MAAM,EAAE,YAAY,EAAC,MAAM,gBAAgB,CAAC;AACpD,OAAO,EAAC,qBAAqB,EAAkB,MAAM,yCAAyC,CAAC;AAG/F,OAAO,KAAK,EAAC,YAAY,IAAI,aAAa,EAAC,MAAM,gBAAgB,CAAC;AAGlE,OAAO,EAAC,iBAAiB,EAAC,MAAM,kBAAkB,CAAC;AAEnD,eAAO,MAAM,iBAAiB;mBACX,MAAM,EAAE;EACvB,CAAC;AAEL,KAAK,QAAQ,GAAG,MAAM,aAAa,CAAC;AAEpC,oDAAoD;AACpD,MAAM,MAAM,iBAAiB,GAAG;IAC5B,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,gBAAgB,CAAC,EAAE,OAAO,CAAC;CAC9B,CAAC;AAEF,4EAA4E;AAC5E,KAAK,QAAQ,CAAC,CAAC,EAAE,CAAC,SAAS,MAAM,IAAI,CAAC,SAAS,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC;AAEtE;;;;;;;;;GASG;AACH,MAAM,MAAM,eAAe,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,EAAE,YAAY,GAAG,mBAAmB,GAAG,QAAQ,GAAG,QAAQ,CAAC,GAAG;IACjG,UAAU,EAAE,QAAQ,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC;IACrC,iBAAiB,EAAE,QAAQ,CAAC,CAAC,EAAE,kBAAkB,CAAC,CAAC;IACnD,MAAM,EAAE,QAAQ,CAAC,CAAC,EAAE,YAAY,CAAC,CAAC;IAClC,MAAM,EAAE,QAAQ,CAAC,CAAC,EAAE,YAAY,CAAC,CAAC;CACrC,CAAC;AAGF,MAAM,MAAM,eAAe,CAAC,CAAC,SAAS,QAAQ,IAAI,eAAe,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC;AAEpF;;;GAGG;AACH,MAAM,MAAM,gBAAgB,CAAC,CAAC,IAAI;KAC7B,CAAC,IAAI,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS;QAAE,QAAQ,EAAE,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,KAAK,GAAG,CAAA;KAAE,GAAG,eAAe,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;CACpG,CAAC;AAEF,qBACa,aAAa;IAaY,OAAO,CAAC,QAAQ,CAAC,iBAAiB;IAZpE,OAAO,CAAC,YAAY,CAA2B;IAC/C,YAAY,EAAE,YAAY,CAAC;IAC3B;;;;;OAKG;IACH,OAAO,CAAC,SAAS,CAAgB;gBAG7B,YAAY,EAAE,YAAY,EACqB,iBAAiB,EAAE,qBAAqB;IAQ3F;;;;;OAKG;IACH,OAAO,CAAC,mBAAmB;IA6B3B,YAAY,CAAC,MAAM,EAAE,OAAO;IAO5B,iBAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC;IAWjE,OAAO,CAAC,KAAK;IAQb,YAAY,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,iBAAiB,KAAK,OAAO,CAAC,CAAC,CAAC;IAIpE,WAAW;IAuFX;;;;OAIG;IACH,gBAAgB,CAAC,CAAC,SAAS,QAAQ,EAAE,KAAK,EAAE,CAAC,GAAG,eAAe,CAAC,CAAC,CAAC;IAoBlE,IAAI,KAAK,IAAI,gBAAgB,CAAC,aAAa,CAAC,CAU3C;IAED,IAAI,IAAI,IAAI,eAAe,CAAC,MAAM,CAAC,CAElC;IAED,IAAI,OAAO,IAAI,eAAe,CAAC,SAAS,CAAC,CAExC;IAED,IAAI,gBAAgB,QAEnB;IAED;;;OAGG;IACH,WAAW;IA+DX;;;;;;;;OAQG;IACH,OAAO,CAAC,kBAAkB;IAkE1B,IAAI,2BAA2B,QAM9B;IAED;;;;;;;;;;;OAWG;IACH;;;;;;;OAOG;IACH,OAAO,CAAC,0BAA0B;IAYlC,mFAAmF;IACnF,OAAO,CAAC,0BAA0B;IAgDlC;;;;;;OAMG;IACH,OAAO,CAAC,uBAAuB;IAQ/B,OAAO,CAAC,0BAA0B;IAOlC,OAAO,CAAC,oBAAoB;IA8K5B;;;;;;;;;;;;;;;;OAgBG;YACW,uBAAuB;IAkDrC;;;;;;;;;;;;;;;;;;;OAmBG;YACW,mBAAmB;IA2BjC,0EAA0E;YAC5D,wBAAwB;IAmCtC,yGAAyG;IACzG,OAAO,CAAC,gBAAgB;IAWxB,4FAA4F;IAC5F,OAAO,CAAC,eAAe;IAcvB;;;;;;;;OAQG;YACW,oBAAoB;IA6ClC;;;;OAIG;IACH,OAAO,CAAC,SAAS;IAKjB;;;;;;OAMG;YACW,2BAA2B;IAqBzC;;;;;;OAMG;IACH,OAAO,CAAC,yBAAyB;IAmBjC;;;;;;;OAOG;YACW,uBAAuB;IA8BrC,oGAAoG;IACpG,OAAO,CAAC,mBAAmB;IAwB3B;;;;;;;OAOG;WACW,gBAAgB,CAAC,UAAU,EAAE,GAAG,EAAE,EAAE,IAAI,EAAE,GAAG,GAAG,GAAG;IAgBjE;;;;;;;OAOG;IACH,OAAO,CAAC,MAAM,CAAC,mBAAmB;IA2BlC;;;;;;;;;;;;;OAaG;IACH,eAAe,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,EAAE;IAI5C;;;;;;;OAOG;IACH,OAAO,CAAC,eAAe;IAUvB;;;;;;;;;;OAUG;IACH,OAAO,CAAC,iBAAiB;IA8EzB,WAAW,CAAC,WAAW,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,eAAe,CAAC,EAAE,IAAI,GAAG;QAC5E,KAAK,EAAE,MAAM,CAAC;QACd,QAAQ,EAAE,MAAM,CAAC;QACjB,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,iBAAiB,CAAC,EAAE,MAAM,CAAC;QAC3B,YAAY,CAAC,EAAE,MAAM,CAAC;QACtB,UAAU,EAAE,OAAO,CAAA;KACtB;IAoBD,gBAAgB,CAAC,WAAW,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM;CAyBzF"}

package/dist/prisma/prisma.service.js

@@ -180,7 +180,15 @@ let PrismaService = exports.PrismaService = PrismaService_1 = class PrismaServic
      * @param model
      */
     getModelDelegate(model) {
-        const modelName = model.toLowerCase();
+        // Prisma exposes delegates in camelCase (`client.albumMember`), lowercasing
+        // only the FIRST character of the model name. Callers pass the PascalCase
+        // class name (`model.name`), so lowercase just the first char — NOT the
+        // whole string, which would flatten any internal capital (`AlbumMember` →
+        // `albummember`) and miss the delegate. (The framework's own model-name
+        // namespace is deliberately whole-lowercase for case-insensitivity, but
+        // that is a separate lookup; this one indexes the real Prisma client.)
+        const name = model;
+        const modelName = name.charAt(0).toLowerCase() + name.slice(1);
         const client = this.prismaClient;
         if (modelName in client) {
             return client[modelName];
@@ -973,6 +981,23 @@ let PrismaService = exports.PrismaService = PrismaService_1 = class PrismaServic
         }
         return condition;
     }
+    /**
+     * The scalar (and enum) field names of a model, as derived from the Prisma
+     * DMMF at bootstrap. Relations are excluded.
+     *
+     * Used by the GraphQL generic resolver to fetch the model's own columns even
+     * when a query only selects a subset, so that a custom `@ResolveField` on the
+     * model type (e.g. a signed-URL transform) can read its source column from
+     * `@Parent()`. ABAC field omission still runs afterward at select-time, so a
+     * `@Role`-restricted column is never actually fetched — callers only ever get
+     * the readable projection.
+     *
+     * @param modelName - The model name (any casing; matched case-insensitively).
+     * @returns The model's scalar field names, or `[]` if the model is unknown.
+     */
+    getScalarFields(modelName) {
+        return this.fieldConfigs[modelName.toLowerCase()]?.scalarFields ?? [];
+    }
     /**
      * Retrieves the list of fields to omit based on the user's role.
      * It checks the field configurations stored in `fieldConfigs` and compares them against the role.

package/docs/graphql.md

@@ -141,7 +141,7 @@ The **generated GraphQL input type is the authoritative allowlist** — an opera
 
 Two framework rules on top of that:
 
-- **You can only filter/sort by fields your role can read.** A `where`/`orderBy` on a `@Role`-hidden column is rejected with `403` — except a presence check (`{ field: null }` / `{ NOT: { field: null } }`), which reveals only whether a value is set.
+- **You can only filter/sort by fields your role can read.** A `where`/`orderBy` on a `@Role`-hidden column is rejected with `403`. The **only** exception is a **bare-null presence check** — `{ field: null }`, `{ field: { equals: null } }`, `{ field: { not: null } }`, or `{ NOT: { field: null } }` — which reveals only whether a value is set. **Any value-bearing predicate on a hidden field still `403`s**, including `{ field: { not: "x" } }` and `{ field: { equals: "x" } }` — anything that compares against a real value. `orderBy` and `distinct` on a hidden field are always rejected (no presence exception).
 - **A malformed value returns a clean `400`.** `createdAt: { gt: 2024 }` (a number where a date is expected) is a `400`, never a `500` or a leaked Prisma error.
 
 ---
@@ -153,7 +153,7 @@ All three operations route through `PrismaService.getModelDelegate`, so the rule
 - **Unauthorized rows are not returned.** `find` returns only rows the role may read; `get` returns `null` for a row the caller can't access even if asked for by unique field; `count` counts only accessible rows.
 - **Restricted fields are omitted.** A column the role can't read (`/// @Role(...)`) comes back **`null`** even though the GraphQL type exposes it — at the top level *and* nested. (`prisma-nestjs-graphql` types every scalar; the proxy is what strips the values.)
 - **Inaccessible nested records are filtered.** If a nested relation points at a record the caller can't read, that relation is filtered out — a to-many yields only the visible rows; an inaccessible to-one drops the parent row. You can hold access to a record while a record it links to is withheld.
-- **You can only filter/sort by fields you can read.** A `where` / `orderBy` / `distinct` that references a field the role can't read (`@Role`) is rejected with `403` — top level or nested — so a hidden column can't be used to filter or order either. The one exception is a **presence/nullness** check in `where`: `{ field: null }` / `{ NOT: { field: null } }` is allowed (it reveals only whether a value is set, not the value), so `hasX` / `isDeleted` patterns work without a bypass.
+- **You can only filter/sort by fields you can read.** A `where` / `orderBy` / `distinct` that references a field the role can't read (`@Role`) is rejected with `403` — top level or nested. The **only** exception is a **bare-null presence check** in `where` (`{ field: null }` / `{ field: { equals: null } }` / `{ field: { not: null } }` / `{ NOT: { field: null } }`) — it reveals only whether a value is set, so `hasX` / `isDeleted` work without a bypass. A **value-bearing** predicate still `403`s (even `{ field: { not: "x" } }`), and `orderBy`/`distinct` on a hidden field have no presence exception.
 - **Anonymous callers are `GUEST`.** With no valid `Authorization: Bearer <jwt>` (or session), the request is a GUEST; a model with no GUEST rule is denied.
 
 > Because relation records and fields are filtered by ABAC, "empty / null" means "not visible to you", not "does not exist". Design queries and UI accordingly.
@@ -162,6 +162,68 @@ Always let the generated resolver serve the data — a custom resolver that reac
 
 ---
 
+## Shaping read output (transforms & computed fields)
+
+To transform a field on the way out (sign a stored S3 key into a URL, mask a value, format a date) or to add a computed field (`slug`, `fullName`), attach a field resolver to the generated model type in the model's module:
+
+```ts
+// src/modules/project/project.fields.ts
+import { Parent, ResolveField, Resolver } from '@nestjs/graphql';
+import { FieldRequires } from '@appxdigital/appx-core';
+import { Project } from '../../generated/project/project.model';
+import { UrlSigner } from '../../shared/url-signer.service';
+
+@Resolver(() => Project)
+export class ProjectFields {
+  constructor(private readonly urls: UrlSigner) {}
+
+  // transform an existing field in place — same name, same type
+  @ResolveField(() => String, { name: 'coverKey', nullable: true })
+  coverKey(@Parent() p: Project) {
+    return p.coverKey ? this.urls.sign(p.coverKey) : null;   // stored key → signed URL
+  }
+
+  // add a computed field — declare the column(s) it reads
+  @ResolveField(() => String, { nullable: true })
+  @FieldRequires('name')
+  slug(@Parent() p: Project) {
+    return p.name ? p.name.toLowerCase().replace(/\s+/g, '-') : null;
+  }
+}
+```
+```ts
+// project.module.ts
+providers: [ProjectService, ProjectResolver, ProjectFields]
+```
+
+The resolver runs wherever the model appears, including nested — `project { find { coverKey } }` and `projectMember { find { project { coverKey } } }` both return the transformed value.
+
+It reads from the already-filtered parent row, so it only ever sees columns the caller's role may read. A field computed from a `@Role`-restricted column receives that column as absent, so a transform cannot surface a value the role can't read.
+
+### `@FieldRequires` — declare a computed field's source columns
+
+A computed field reads columns from its parent, but the query fetches only the columns the client selected. Declare the columns the field reads so they are fetched even when the client didn't select them:
+
+```ts
+@ResolveField(() => String, { nullable: true })
+@FieldRequires('coverKey')                  // one column
+coverUrl(@Parent() p: Project) { … }
+
+@ResolveField(() => String, { nullable: true })
+@FieldRequires(['firstName', 'lastName'])   // a list, or @FieldRequires('firstName', 'lastName')
+fullName(@Parent() p: Project) { … }
+```
+
+- **Declared** → only those columns are fetched for the field.
+- **Not declared** → all of the model's scalar columns are fetched, so the field can read any of them from its parent.
+- **In-place transform** (a resolver reusing an existing field's name) → needs no declaration; that column is fetched whenever the client selects the field.
+
+Read from `@Parent()`, not the raw Prisma client — re-querying bypasses ABAC. For key-to-URL transforms, reuse the existing field's name so the raw stored value never leaves the server.
+
+> The REST CRUD endpoints return rows as stored; output shaping applies to the GraphQL read API.
+
+---
+
 ## Not available yet
 
 - **Mutations** (create/update/delete) — use REST.

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@appxdigital/appx-core",
-    "version": "0.1.128-beta.2",
+    "version": "0.1.128-beta.4",
     "description": "Appx Core is a library that provides a set of tools to help you build your application faster.",
     "main": "dist/index.js",
     "types": "dist/index.d.ts",