@appxdigital/appx-core 0.1.128-beta.3 → 0.1.128-beta.4

package/CHANGELOG.md

@@ -29,6 +29,8 @@ Read-only GraphQL, reworked into a **namespaced, opt-in-per-module** API.
 - **Nested selection is to-one only.** Generated GraphQL model types expose scalars, **to-one** relations, and `_count`; **to-many relations are not nested-selectable** (nested lists have no pagination, so they could return unbounded rows). Fetch a list at the top level with pagination — `track { find(where: { albumId … }, take, skip) }`. Filtering by a to-many relation in `where` (`some`/`every`/`none`) and `_count { … }` still work.
 - **Self-documenting operations.** `find` / `get` / `count` and their `where` arg carry GraphQL descriptions (visible in the Apollo Sandbox); model-field descriptions come from Prisma `///` doc comments as before. See [docs/graphql.md](./docs/graphql.md) for the full `where`/`orderBy`/pagination reference.
 - **Malformed filter values return `400`, not `500`.** A `where`/`orderBy` value Prisma can't parse (e.g. `createdAt: { gt: 2024 }` — a number where a date is expected) now surfaces a clean `400`, instead of an internal error that leaked the raw Prisma invocation.
+- **Output shaping via native field resolvers.** Transform a field on the way out (sign a stored key into a URL, mask, format) or add a computed field with a `@Resolver(() => Model)` + `@ResolveField`, registered in the module. A field resolver reads its source columns from `@Parent()`; ABAC field omission still runs at query time, so a transform never sees a `@Role`-restricted column. New **`@FieldRequires('col')`** (one column, several, or an array) declares which columns a computed field reads so the generated `find`/`get` fetches exactly those; undeclared computed fields fall back to fetching all scalar columns, and relations always stay selection-driven. See [docs/graphql.md](./docs/graphql.md) → *Shaping read output*.
+- **GraphQL introspection on in development.** The Apollo Sandbox (`GET /graphql`) needs introspection, which Apollo Server v4 disables under `NODE_ENV=production` (`INTROSPECTION_DISABLED`). It is now enabled in development and disabled in production by default (defense-in-depth — introspection exposes schema shape, not data, which ABAC still governs). Opt in for a production deployment with `APPX_GRAPHQL_INTROSPECTION=true`.
 
 ### Fixed
 

package/dist/common/decorators/field-requires.decorator.d.ts

@@ -0,0 +1,50 @@
+/**
+ * The GraphQL schema-field `extensions` key under which {@link FieldRequires}
+ * records the source columns. The generated read resolver reads it back from the
+ * schema when deciding which columns to fetch
+ * (see `generic.resolver.ts` → `selectReadColumns`).
+ */
+export declare const FIELD_REQUIRES_EXTENSION = "requires";
+/**
+ * Declare the model columns a custom GraphQL `@ResolveField` reads from its
+ * `@Parent()`, so the generated `find` / `get` fetches those columns even when
+ * the client didn't select them.
+ *
+ * Use it on a computed field whose value derives from a column — e.g. a signed
+ * `coverUrl` built from a stored `coverKey`. Without it, only the columns the
+ * client selected are fetched and `@Parent().coverKey` would be `undefined`.
+ *
+ * - Declared → only the listed columns are fetched for the field.
+ * - Not declared → all of the model's scalar columns are fetched.
+ * - Not needed for an in-place transform that reuses an existing field's name.
+ *
+ * ABAC applies: a column the caller's role may not read is omitted at query time,
+ * so the resolver sees it as absent — a transform can never surface a
+ * `@Role`-restricted value.
+ *
+ * Accepts a single column, several columns, or an array.
+ *
+ * @param columns - The scalar column name(s) the resolver reads from its parent.
+ *
+ * @example
+ * ```ts
+ * @Resolver(() => Project)
+ * export class ProjectFields {
+ *   constructor(private readonly urls: UrlSigner) {}
+ *
+ *   @ResolveField(() => String, { nullable: true })
+ *   @FieldRequires('coverKey')
+ *   coverUrl(@Parent() p: Project) {
+ *     return p.coverKey ? this.urls.sign(p.coverKey) : null;
+ *   }
+ *
+ *   @ResolveField(() => String, { nullable: true })
+ *   @FieldRequires(['firstName', 'lastName'])
+ *   fullName(@Parent() p: Project) {
+ *     return [p.firstName, p.lastName].filter(Boolean).join(' ') || null;
+ *   }
+ * }
+ * ```
+ */
+export declare const FieldRequires: (...columns: (string | string[])[]) => MethodDecorator & ClassDecorator & PropertyDecorator;
+//# sourceMappingURL=field-requires.decorator.d.ts.map

package/dist/common/decorators/field-requires.decorator.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"field-requires.decorator.d.ts","sourceRoot":"","sources":["../../../src/common/decorators/field-requires.decorator.ts"],"names":[],"mappings":"AAEA;;;;;GAKG;AACH,eAAO,MAAM,wBAAwB,aAAa,CAAC;AAEnD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AACH,eAAO,MAAM,aAAa,eAAgB,CAAC,MAAM,GAAG,MAAM,EAAE,CAAC,EAAE,yDACH,CAAC"}

package/dist/common/decorators/field-requires.decorator.js

@@ -0,0 +1,54 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.FieldRequires = exports.FIELD_REQUIRES_EXTENSION = void 0;
+const graphql_1 = require("@nestjs/graphql");
+/**
+ * The GraphQL schema-field `extensions` key under which {@link FieldRequires}
+ * records the source columns. The generated read resolver reads it back from the
+ * schema when deciding which columns to fetch
+ * (see `generic.resolver.ts` → `selectReadColumns`).
+ */
+exports.FIELD_REQUIRES_EXTENSION = 'requires';
+/**
+ * Declare the model columns a custom GraphQL `@ResolveField` reads from its
+ * `@Parent()`, so the generated `find` / `get` fetches those columns even when
+ * the client didn't select them.
+ *
+ * Use it on a computed field whose value derives from a column — e.g. a signed
+ * `coverUrl` built from a stored `coverKey`. Without it, only the columns the
+ * client selected are fetched and `@Parent().coverKey` would be `undefined`.
+ *
+ * - Declared → only the listed columns are fetched for the field.
+ * - Not declared → all of the model's scalar columns are fetched.
+ * - Not needed for an in-place transform that reuses an existing field's name.
+ *
+ * ABAC applies: a column the caller's role may not read is omitted at query time,
+ * so the resolver sees it as absent — a transform can never surface a
+ * `@Role`-restricted value.
+ *
+ * Accepts a single column, several columns, or an array.
+ *
+ * @param columns - The scalar column name(s) the resolver reads from its parent.
+ *
+ * @example
+ * ```ts
+ * @Resolver(() => Project)
+ * export class ProjectFields {
+ *   constructor(private readonly urls: UrlSigner) {}
+ *
+ *   @ResolveField(() => String, { nullable: true })
+ *   @FieldRequires('coverKey')
+ *   coverUrl(@Parent() p: Project) {
+ *     return p.coverKey ? this.urls.sign(p.coverKey) : null;
+ *   }
+ *
+ *   @ResolveField(() => String, { nullable: true })
+ *   @FieldRequires(['firstName', 'lastName'])
+ *   fullName(@Parent() p: Project) {
+ *     return [p.firstName, p.lastName].filter(Boolean).join(' ') || null;
+ *   }
+ * }
+ * ```
+ */
+const FieldRequires = (...columns) => (0, graphql_1.Extensions)({ [exports.FIELD_REQUIRES_EXTENSION]: columns.flat() });
+exports.FieldRequires = FieldRequires;

package/dist/graphql/generic.resolver.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"generic.resolver.d.ts","sourceRoot":"","sources":["../../src/graphql/generic.resolver.ts"],"names":[],"mappings":"AAEA,OAAO,EAAC,IAAI,EAAC,MAAM,iBAAiB,CAAC;AAwBrC;;;;GAIG;AACH,MAAM,WAAW,kBAAkB,CAAC,SAAS,GAAG,GAAG;IAC/C,iFAAiF;IACjF,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;IACvB,gFAAgF;IAChF,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,oDAAoD;IACpD,YAAY,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC;IACxB,oDAAoD;IACpD,aAAa,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC;IACzB,8DAA8D;IAC9D,UAAU,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC;CACzB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,wBAAgB,mBAAmB,CAAC,SAAS,EAAE,MAAM,EAAE,kBAAkB,CAAC,SAAS,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,CAuE/F"}
+{"version":3,"file":"generic.resolver.d.ts","sourceRoot":"","sources":["../../src/graphql/generic.resolver.ts"],"names":[],"mappings":"AAEA,OAAO,EAAC,IAAI,EAAC,MAAM,iBAAiB,CAAC;AA4GrC;;;;GAIG;AACH,MAAM,WAAW,kBAAkB,CAAC,SAAS,GAAG,GAAG;IAC/C,iFAAiF;IACjF,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;IACvB,gFAAgF;IAChF,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,oDAAoD;IACpD,YAAY,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC;IACxB,oDAAoD;IACpD,aAAa,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC;IACzB,8DAA8D;IAC9D,UAAU,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC;CACzB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,wBAAgB,mBAAmB,CAAC,SAAS,EAAE,MAAM,EAAE,kBAAkB,CAAC,SAAS,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,CAuE/F"}

package/dist/graphql/generic.resolver.js

@@ -16,7 +16,9 @@ exports.CoreGraphqlResolver = void 0;
 const graphql_1 = require("@nestjs/graphql");
 const common_1 = require("@nestjs/common");
 const plugins_1 = require("@paljs/plugins");
+const graphql_2 = require("graphql");
 const prisma_service_1 = require("../prisma/prisma.service");
+const field_requires_decorator_1 = require("../common/decorators/field-requires.decorator");
 /**
  * Run a read and translate a Prisma **validation** error into a `400`. A
  * malformed `where`/`orderBy` value (e.g. `createdAt: { gt: 2024 }` — a number
@@ -36,6 +38,85 @@ async function readOrBadRequest(op) {
         throw e;
     }
 }
+/**
+ * Turn a `PrismaSelect`-derived selection into the columns actually fetched,
+ * resolving the source columns that custom `@ResolveField`s need.
+ *
+ * `PrismaSelect` narrows the Prisma query to exactly the fields the GraphQL
+ * request asked for. That breaks the standard NestJS code-first contract where a
+ * `@ResolveField` on the model type receives the full entity as `@Parent()`: a
+ * custom field (`coverUrl` derived from a `coverKey` column, or a signed-URL
+ * transform of an existing field) can't read a source column the client didn't
+ * also select. We restore that contract with a **hybrid** strategy that avoids
+ * over-fetching:
+ *
+ *   - A custom field can declare its source columns natively, via the standard
+ *     NestJS field `extensions`:
+ *         `@ResolveField(() => String, { extensions: { requires: ['coverKey'] } })`
+ *     When declared, ONLY those columns are added — no over-fetch.
+ *   - A custom field that declares nothing falls back to fetching all of the
+ *     model's scalar columns (safe default: the resolver can read anything from
+ *     `@Parent()`), at the cost of reading columns the query didn't select.
+ *   - A query that selects no custom fields fetches exactly what was asked for.
+ *
+ * Relations stay selection-driven throughout (no unbounded relation fetching).
+ * ABAC field omission runs afterward in the proxy and strips `@Role`-restricted
+ * columns at select-time, so a caller still only ever receives — and a transform
+ * only ever sees — the columns their role may read.
+ *
+ * Custom field names (no backing column) are dropped from the Prisma `select`:
+ * `PrismaSelect` puts every requested GraphQL field there, and passing a name
+ * Prisma doesn't recognise throws a validation error. They resolve from the
+ * parent afterward, so they must not reach the query.
+ */
+function selectReadColumns(select, info, prisma, modelName) {
+    const scalars = new Set(prisma.getScalarFields(modelName));
+    const requested = select?.select && typeof select.select === 'object' ? select.select : {};
+    // The GraphQL type of the returned rows, to read each field's
+    // `extensions.requires` (find → [Model], get → Model; getNamedType unwraps).
+    const named = (0, graphql_2.getNamedType)(info.returnType);
+    const gqlFields = named instanceof graphql_2.GraphQLObjectType ? named.getFields() : {};
+    const out = {};
+    const requiredColumns = new Set();
+    let needAllScalars = false;
+    for (const [key, value] of Object.entries(requested)) {
+        if (value && typeof value === 'object') {
+            out[key] = value; // a relation (or `_count`) selection — keep as-is
+        }
+        else if (scalars.has(key)) {
+            out[key] = value; // a real scalar column
+        }
+        else {
+            // A custom field resolver (no backing column). Prefer its declared
+            // dependencies (@FieldRequires); otherwise fall back to all scalars.
+            const requires = gqlFields[key]?.extensions?.[field_requires_decorator_1.FIELD_REQUIRES_EXTENSION];
+            if (Array.isArray(requires)) {
+                for (const col of requires) {
+                    if (scalars.has(col))
+                        requiredColumns.add(col);
+                }
+            }
+            else {
+                needAllScalars = true;
+            }
+        }
+    }
+    if (needAllScalars) {
+        for (const field of scalars)
+            out[field] = true;
+    }
+    else {
+        for (const col of requiredColumns)
+            out[col] = true;
+    }
+    // Guard against an empty select (e.g. only a custom field with `requires: []`)
+    // — an empty Prisma `select` is invalid; fall back to all scalars.
+    if (Object.keys(out).length === 0) {
+        for (const field of scalars)
+            out[field] = true;
+    }
+    return { ...(select && typeof select === 'object' ? select : {}), select: out };
+}
 /**
  * Build a **namespaced, read-only** GraphQL resolver for one model.
  *
@@ -87,11 +168,11 @@ function CoreGraphqlResolver(bundle) {
             return {};
         }
         async find(args, info) {
-            const select = new plugins_1.PrismaSelect(info).value;
+            const select = selectReadColumns(new plugins_1.PrismaSelect(info).value, info, this.prisma, modelName);
             return readOrBadRequest(() => this.prisma.getModelDelegate(modelName).findMany({ ...args, ...select }));
         }
         async get(args, info) {
-            const select = new plugins_1.PrismaSelect(info).value;
+            const select = selectReadColumns(new plugins_1.PrismaSelect(info).value, info, this.prisma, modelName);
             return readOrBadRequest(() => this.prisma.getModelDelegate(modelName).findFirst({ ...args, ...select }));
         }
         async count(where) {

package/dist/graphql/graphql.module.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"graphql.module.d.ts","sourceRoot":"","sources":["../../src/graphql/graphql.module.ts"],"names":[],"mappings":"AAKA;;;;;GAKG;AACH,qBACa,oBAAoB;IAK7B,QAAQ,IAAI,MAAM;CAGrB;AAED,qBAca,aAAa;CAAG"}
+{"version":3,"file":"graphql.module.d.ts","sourceRoot":"","sources":["../../src/graphql/graphql.module.ts"],"names":[],"mappings":"AAKA;;;;;GAKG;AACH,qBACa,oBAAoB;IAK7B,QAAQ,IAAI,MAAM;CAGrB;AAED,qBAwBa,aAAa;CAAG"}

package/dist/graphql/graphql.module.js

@@ -49,6 +49,15 @@ exports.GraphqlModule = GraphqlModule = __decorate([
                 // `src/generated/` path at boot (CI, read-only deploys, tests).
                 autoSchemaFile: true,
                 sortSchema: true,
+                // Introspection powers the Apollo Sandbox (GET /graphql). It exposes
+                // the schema shape (not data — ABAC still governs every field), so we
+                // keep it ON in development for the Sandbox, and OFF in production as
+                // defense-in-depth (less recon surface). Opt back in for a production
+                // deployment with APPX_GRAPHQL_INTROSPECTION=true. Without this, Apollo
+                // Server v4 disables introspection under NODE_ENV=production and the
+                // Sandbox fails with `INTROSPECTION_DISABLED`.
+                introspection: process.env.NODE_ENV !== 'production' ||
+                    process.env.APPX_GRAPHQL_INTROSPECTION === 'true',
             }),
         ],
         providers: [AppxCoreRootResolver],

package/dist/index.d.ts

@@ -37,6 +37,7 @@ export * from './common/interfaces/storage-service.interface';
 export * from './modules/file/file-upload.controller';
 export * from './modules/file/file-upload.service';
 export * from './common/decorators/permission.decorator';
+export * from './common/decorators/field-requires.decorator';
 export * from './common/setup/setup-core-security';
 export * from './common/setup/core-config';
 export * from './common/interceptors/file.interceptor';

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,4BAA4B,CAAC;AAC3C,cAAc,6BAA6B,CAAC;AAC5C,cAAc,gCAAgC,CAAC;AAC/C,cAAc,yBAAyB,CAAC;AACxC,cAAc,0BAA0B,CAAC;AACzC,cAAc,4BAA4B,CAAC;AAC3C,cAAc,iCAAiC,CAAC;AAChD,cAAc,4BAA4B,CAAC;AAI3C,cAAc,gCAAgC,CAAC;AAC/C,cAAc,6BAA6B,CAAC;AAC5C,cAAc,iCAAiC,CAAC;AAChD,cAAc,6BAA6B,CAAC;AAC5C,cAAc,qCAAqC,CAAC;AACpD,cAAc,+BAA+B,CAAC;AAC9C,cAAc,iCAAiC,CAAC;AAChD,cAAc,6BAA6B,CAAC;AAC5C,cAAc,uCAAuC,CAAC;AACtD,cAAc,oCAAoC,CAAC;AACnD,cAAc,2CAA2C,CAAC;AAC1D,cAAc,2CAA2C,CAAC;AAC1D,cAAc,sCAAsC,CAAC;AACrD,cAAc,4BAA4B,CAAC;AAC3C,cAAc,uCAAuC,CAAC;AACtD,cAAc,yBAAyB,CAAC;AACxC,cAAc,0CAA0C,CAAC;AACzD,cAAc,4CAA4C,CAAC;AAC3D,cAAc,+BAA+B,CAAC;AAC9C,cAAc,oCAAoC,CAAC;AACnD,cAAc,wCAAwC,CAAC;AACvD,cAAc,iCAAiC,CAAC;AAChD,cAAc,6CAA6C,CAAC;AAC5D,cAAc,oBAAoB,CAAC;AACnC,cAAc,mCAAmC,CAAC;AAClD,cAAc,2CAA2C,CAAC;AAC1D,cAAc,wCAAwC,CAAC;AACvD,cAAc,+CAA+C,CAAC;AAC9D,cAAc,uCAAuC,CAAC;AACtD,cAAc,oCAAoC,CAAC;AACnD,cAAc,0CAA0C,CAAC;AACzD,cAAc,oCAAoC,CAAC;AACnD,cAAc,4BAA4B,CAAC;AAC3C,cAAc,wCAAwC,CAAC;AACvD,cAAc,oCAAoC,CAAC;AACnD,cAAc,+BAA+B,CAAC;AAC9C,cAAc,qCAAqC,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,4BAA4B,CAAC;AAC3C,cAAc,6BAA6B,CAAC;AAC5C,cAAc,gCAAgC,CAAC;AAC/C,cAAc,yBAAyB,CAAC;AACxC,cAAc,0BAA0B,CAAC;AACzC,cAAc,4BAA4B,CAAC;AAC3C,cAAc,iCAAiC,CAAC;AAChD,cAAc,4BAA4B,CAAC;AAI3C,cAAc,gCAAgC,CAAC;AAC/C,cAAc,6BAA6B,CAAC;AAC5C,cAAc,iCAAiC,CAAC;AAChD,cAAc,6BAA6B,CAAC;AAC5C,cAAc,qCAAqC,CAAC;AACpD,cAAc,+BAA+B,CAAC;AAC9C,cAAc,iCAAiC,CAAC;AAChD,cAAc,6BAA6B,CAAC;AAC5C,cAAc,uCAAuC,CAAC;AACtD,cAAc,oCAAoC,CAAC;AACnD,cAAc,2CAA2C,CAAC;AAC1D,cAAc,2CAA2C,CAAC;AAC1D,cAAc,sCAAsC,CAAC;AACrD,cAAc,4BAA4B,CAAC;AAC3C,cAAc,uCAAuC,CAAC;AACtD,cAAc,yBAAyB,CAAC;AACxC,cAAc,0CAA0C,CAAC;AACzD,cAAc,4CAA4C,CAAC;AAC3D,cAAc,+BAA+B,CAAC;AAC9C,cAAc,oCAAoC,CAAC;AACnD,cAAc,wCAAwC,CAAC;AACvD,cAAc,iCAAiC,CAAC;AAChD,cAAc,6CAA6C,CAAC;AAC5D,cAAc,oBAAoB,CAAC;AACnC,cAAc,mCAAmC,CAAC;AAClD,cAAc,2CAA2C,CAAC;AAC1D,cAAc,wCAAwC,CAAC;AACvD,cAAc,+CAA+C,CAAC;AAC9D,cAAc,uCAAuC,CAAC;AACtD,cAAc,oCAAoC,CAAC;AACnD,cAAc,0CAA0C,CAAC;AACzD,cAAc,8CAA8C,CAAC;AAC7D,cAAc,oCAAoC,CAAC;AACnD,cAAc,4BAA4B,CAAC;AAC3C,cAAc,wCAAwC,CAAC;AACvD,cAAc,oCAAoC,CAAC;AACnD,cAAc,+BAA+B,CAAC;AAC9C,cAAc,qCAAqC,CAAC"}

package/dist/index.js

@@ -56,6 +56,7 @@ __exportStar(require("./common/interfaces/storage-service.interface"), exports);
 __exportStar(require("./modules/file/file-upload.controller"), exports);
 __exportStar(require("./modules/file/file-upload.service"), exports);
 __exportStar(require("./common/decorators/permission.decorator"), exports);
+__exportStar(require("./common/decorators/field-requires.decorator"), exports);
 __exportStar(require("./common/setup/setup-core-security"), exports);
 __exportStar(require("./common/setup/core-config"), exports);
 __exportStar(require("./common/interceptors/file.interceptor"), exports);

package/dist/prisma/prisma.service.d.ts

@@ -229,6 +229,21 @@ export declare class PrismaService {
      * @returns The condition with placeholders replaced by actual values.
      */
     private static replacePlaceholders;
+    /**
+     * The scalar (and enum) field names of a model, as derived from the Prisma
+     * DMMF at bootstrap. Relations are excluded.
+     *
+     * Used by the GraphQL generic resolver to fetch the model's own columns even
+     * when a query only selects a subset, so that a custom `@ResolveField` on the
+     * model type (e.g. a signed-URL transform) can read its source column from
+     * `@Parent()`. ABAC field omission still runs afterward at select-time, so a
+     * `@Role`-restricted column is never actually fetched — callers only ever get
+     * the readable projection.
+     *
+     * @param modelName - The model name (any casing; matched case-insensitively).
+     * @returns The model's scalar field names, or `[]` if the model is unknown.
+     */
+    getScalarFields(modelName: string): string[];
     /**
      * Retrieves the list of fields to omit based on the user's role.
      * It checks the field configurations stored in `fieldConfigs` and compares them against the role.

package/dist/prisma/prisma.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"prisma.service.d.ts","sourceRoot":"","sources":["../../src/prisma/prisma.service.ts"],"names":[],"mappings":";AACA,OAAO,EAAC,MAAM,EAAE,YAAY,EAAC,MAAM,gBAAgB,CAAC;AACpD,OAAO,EAAC,qBAAqB,EAAkB,MAAM,yCAAyC,CAAC;AAG/F,OAAO,KAAK,EAAC,YAAY,IAAI,aAAa,EAAC,MAAM,gBAAgB,CAAC;AAGlE,OAAO,EAAC,iBAAiB,EAAC,MAAM,kBAAkB,CAAC;AAEnD,eAAO,MAAM,iBAAiB;mBACX,MAAM,EAAE;EACvB,CAAC;AAEL,KAAK,QAAQ,GAAG,MAAM,aAAa,CAAC;AAEpC,oDAAoD;AACpD,MAAM,MAAM,iBAAiB,GAAG;IAC5B,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,gBAAgB,CAAC,EAAE,OAAO,CAAC;CAC9B,CAAC;AAEF,4EAA4E;AAC5E,KAAK,QAAQ,CAAC,CAAC,EAAE,CAAC,SAAS,MAAM,IAAI,CAAC,SAAS,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC;AAEtE;;;;;;;;;GASG;AACH,MAAM,MAAM,eAAe,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,EAAE,YAAY,GAAG,mBAAmB,GAAG,QAAQ,GAAG,QAAQ,CAAC,GAAG;IACjG,UAAU,EAAE,QAAQ,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC;IACrC,iBAAiB,EAAE,QAAQ,CAAC,CAAC,EAAE,kBAAkB,CAAC,CAAC;IACnD,MAAM,EAAE,QAAQ,CAAC,CAAC,EAAE,YAAY,CAAC,CAAC;IAClC,MAAM,EAAE,QAAQ,CAAC,CAAC,EAAE,YAAY,CAAC,CAAC;CACrC,CAAC;AAGF,MAAM,MAAM,eAAe,CAAC,CAAC,SAAS,QAAQ,IAAI,eAAe,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC;AAEpF;;;GAGG;AACH,MAAM,MAAM,gBAAgB,CAAC,CAAC,IAAI;KAC7B,CAAC,IAAI,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS;QAAE,QAAQ,EAAE,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,KAAK,GAAG,CAAA;KAAE,GAAG,eAAe,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;CACpG,CAAC;AAEF,qBACa,aAAa;IAaY,OAAO,CAAC,QAAQ,CAAC,iBAAiB;IAZpE,OAAO,CAAC,YAAY,CAA2B;IAC/C,YAAY,EAAE,YAAY,CAAC;IAC3B;;;;;OAKG;IACH,OAAO,CAAC,SAAS,CAAgB;gBAG7B,YAAY,EAAE,YAAY,EACqB,iBAAiB,EAAE,qBAAqB;IAQ3F;;;;;OAKG;IACH,OAAO,CAAC,mBAAmB;IA6B3B,YAAY,CAAC,MAAM,EAAE,OAAO;IAO5B,iBAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC;IAWjE,OAAO,CAAC,KAAK;IAQb,YAAY,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,iBAAiB,KAAK,OAAO,CAAC,CAAC,CAAC;IAIpE,WAAW;IAuFX;;;;OAIG;IACH,gBAAgB,CAAC,CAAC,SAAS,QAAQ,EAAE,KAAK,EAAE,CAAC,GAAG,eAAe,CAAC,CAAC,CAAC;IAoBlE,IAAI,KAAK,IAAI,gBAAgB,CAAC,aAAa,CAAC,CAU3C;IAED,IAAI,IAAI,IAAI,eAAe,CAAC,MAAM,CAAC,CAElC;IAED,IAAI,OAAO,IAAI,eAAe,CAAC,SAAS,CAAC,CAExC;IAED,IAAI,gBAAgB,QAEnB;IAED;;;OAGG;IACH,WAAW;IA+DX;;;;;;;;OAQG;IACH,OAAO,CAAC,kBAAkB;IAkE1B,IAAI,2BAA2B,QAM9B;IAED;;;;;;;;;;;OAWG;IACH;;;;;;;OAOG;IACH,OAAO,CAAC,0BAA0B;IAYlC,mFAAmF;IACnF,OAAO,CAAC,0BAA0B;IAgDlC;;;;;;OAMG;IACH,OAAO,CAAC,uBAAuB;IAQ/B,OAAO,CAAC,0BAA0B;IAOlC,OAAO,CAAC,oBAAoB;IA8K5B;;;;;;;;;;;;;;;;OAgBG;YACW,uBAAuB;IAkDrC;;;;;;;;;;;;;;;;;;;OAmBG;YACW,mBAAmB;IA2BjC,0EAA0E;YAC5D,wBAAwB;IAmCtC,yGAAyG;IACzG,OAAO,CAAC,gBAAgB;IAWxB,4FAA4F;IAC5F,OAAO,CAAC,eAAe;IAcvB;;;;;;;;OAQG;YACW,oBAAoB;IA6ClC;;;;OAIG;IACH,OAAO,CAAC,SAAS;IAKjB;;;;;;OAMG;YACW,2BAA2B;IAqBzC;;;;;;OAMG;IACH,OAAO,CAAC,yBAAyB;IAmBjC;;;;;;;OAOG;YACW,uBAAuB;IA8BrC,oGAAoG;IACpG,OAAO,CAAC,mBAAmB;IAwB3B;;;;;;;OAOG;WACW,gBAAgB,CAAC,UAAU,EAAE,GAAG,EAAE,EAAE,IAAI,EAAE,GAAG,GAAG,GAAG;IAgBjE;;;;;;;OAOG;IACH,OAAO,CAAC,MAAM,CAAC,mBAAmB;IA2BlC;;;;;;;OAOG;IACH,OAAO,CAAC,eAAe;IAUvB;;;;;;;;;;OAUG;IACH,OAAO,CAAC,iBAAiB;IA8EzB,WAAW,CAAC,WAAW,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,eAAe,CAAC,EAAE,IAAI,GAAG;QAC5E,KAAK,EAAE,MAAM,CAAC;QACd,QAAQ,EAAE,MAAM,CAAC;QACjB,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,iBAAiB,CAAC,EAAE,MAAM,CAAC;QAC3B,YAAY,CAAC,EAAE,MAAM,CAAC;QACtB,UAAU,EAAE,OAAO,CAAA;KACtB;IAoBD,gBAAgB,CAAC,WAAW,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM;CAyBzF"}
+{"version":3,"file":"prisma.service.d.ts","sourceRoot":"","sources":["../../src/prisma/prisma.service.ts"],"names":[],"mappings":";AACA,OAAO,EAAC,MAAM,EAAE,YAAY,EAAC,MAAM,gBAAgB,CAAC;AACpD,OAAO,EAAC,qBAAqB,EAAkB,MAAM,yCAAyC,CAAC;AAG/F,OAAO,KAAK,EAAC,YAAY,IAAI,aAAa,EAAC,MAAM,gBAAgB,CAAC;AAGlE,OAAO,EAAC,iBAAiB,EAAC,MAAM,kBAAkB,CAAC;AAEnD,eAAO,MAAM,iBAAiB;mBACX,MAAM,EAAE;EACvB,CAAC;AAEL,KAAK,QAAQ,GAAG,MAAM,aAAa,CAAC;AAEpC,oDAAoD;AACpD,MAAM,MAAM,iBAAiB,GAAG;IAC5B,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,gBAAgB,CAAC,EAAE,OAAO,CAAC;CAC9B,CAAC;AAEF,4EAA4E;AAC5E,KAAK,QAAQ,CAAC,CAAC,EAAE,CAAC,SAAS,MAAM,IAAI,CAAC,SAAS,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC;AAEtE;;;;;;;;;GASG;AACH,MAAM,MAAM,eAAe,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,EAAE,YAAY,GAAG,mBAAmB,GAAG,QAAQ,GAAG,QAAQ,CAAC,GAAG;IACjG,UAAU,EAAE,QAAQ,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC;IACrC,iBAAiB,EAAE,QAAQ,CAAC,CAAC,EAAE,kBAAkB,CAAC,CAAC;IACnD,MAAM,EAAE,QAAQ,CAAC,CAAC,EAAE,YAAY,CAAC,CAAC;IAClC,MAAM,EAAE,QAAQ,CAAC,CAAC,EAAE,YAAY,CAAC,CAAC;CACrC,CAAC;AAGF,MAAM,MAAM,eAAe,CAAC,CAAC,SAAS,QAAQ,IAAI,eAAe,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC;AAEpF;;;GAGG;AACH,MAAM,MAAM,gBAAgB,CAAC,CAAC,IAAI;KAC7B,CAAC,IAAI,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS;QAAE,QAAQ,EAAE,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,KAAK,GAAG,CAAA;KAAE,GAAG,eAAe,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;CACpG,CAAC;AAEF,qBACa,aAAa;IAaY,OAAO,CAAC,QAAQ,CAAC,iBAAiB;IAZpE,OAAO,CAAC,YAAY,CAA2B;IAC/C,YAAY,EAAE,YAAY,CAAC;IAC3B;;;;;OAKG;IACH,OAAO,CAAC,SAAS,CAAgB;gBAG7B,YAAY,EAAE,YAAY,EACqB,iBAAiB,EAAE,qBAAqB;IAQ3F;;;;;OAKG;IACH,OAAO,CAAC,mBAAmB;IA6B3B,YAAY,CAAC,MAAM,EAAE,OAAO;IAO5B,iBAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC;IAWjE,OAAO,CAAC,KAAK;IAQb,YAAY,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,iBAAiB,KAAK,OAAO,CAAC,CAAC,CAAC;IAIpE,WAAW;IAuFX;;;;OAIG;IACH,gBAAgB,CAAC,CAAC,SAAS,QAAQ,EAAE,KAAK,EAAE,CAAC,GAAG,eAAe,CAAC,CAAC,CAAC;IAoBlE,IAAI,KAAK,IAAI,gBAAgB,CAAC,aAAa,CAAC,CAU3C;IAED,IAAI,IAAI,IAAI,eAAe,CAAC,MAAM,CAAC,CAElC;IAED,IAAI,OAAO,IAAI,eAAe,CAAC,SAAS,CAAC,CAExC;IAED,IAAI,gBAAgB,QAEnB;IAED;;;OAGG;IACH,WAAW;IA+DX;;;;;;;;OAQG;IACH,OAAO,CAAC,kBAAkB;IAkE1B,IAAI,2BAA2B,QAM9B;IAED;;;;;;;;;;;OAWG;IACH;;;;;;;OAOG;IACH,OAAO,CAAC,0BAA0B;IAYlC,mFAAmF;IACnF,OAAO,CAAC,0BAA0B;IAgDlC;;;;;;OAMG;IACH,OAAO,CAAC,uBAAuB;IAQ/B,OAAO,CAAC,0BAA0B;IAOlC,OAAO,CAAC,oBAAoB;IA8K5B;;;;;;;;;;;;;;;;OAgBG;YACW,uBAAuB;IAkDrC;;;;;;;;;;;;;;;;;;;OAmBG;YACW,mBAAmB;IA2BjC,0EAA0E;YAC5D,wBAAwB;IAmCtC,yGAAyG;IACzG,OAAO,CAAC,gBAAgB;IAWxB,4FAA4F;IAC5F,OAAO,CAAC,eAAe;IAcvB;;;;;;;;OAQG;YACW,oBAAoB;IA6ClC;;;;OAIG;IACH,OAAO,CAAC,SAAS;IAKjB;;;;;;OAMG;YACW,2BAA2B;IAqBzC;;;;;;OAMG;IACH,OAAO,CAAC,yBAAyB;IAmBjC;;;;;;;OAOG;YACW,uBAAuB;IA8BrC,oGAAoG;IACpG,OAAO,CAAC,mBAAmB;IAwB3B;;;;;;;OAOG;WACW,gBAAgB,CAAC,UAAU,EAAE,GAAG,EAAE,EAAE,IAAI,EAAE,GAAG,GAAG,GAAG;IAgBjE;;;;;;;OAOG;IACH,OAAO,CAAC,MAAM,CAAC,mBAAmB;IA2BlC;;;;;;;;;;;;;OAaG;IACH,eAAe,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,EAAE;IAI5C;;;;;;;OAOG;IACH,OAAO,CAAC,eAAe;IAUvB;;;;;;;;;;OAUG;IACH,OAAO,CAAC,iBAAiB;IA8EzB,WAAW,CAAC,WAAW,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,eAAe,CAAC,EAAE,IAAI,GAAG;QAC5E,KAAK,EAAE,MAAM,CAAC;QACd,QAAQ,EAAE,MAAM,CAAC;QACjB,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,iBAAiB,CAAC,EAAE,MAAM,CAAC;QAC3B,YAAY,CAAC,EAAE,MAAM,CAAC;QACtB,UAAU,EAAE,OAAO,CAAA;KACtB;IAoBD,gBAAgB,CAAC,WAAW,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM;CAyBzF"}

package/dist/prisma/prisma.service.js

@@ -981,6 +981,23 @@ let PrismaService = exports.PrismaService = PrismaService_1 = class PrismaServic
         }
         return condition;
     }
+    /**
+     * The scalar (and enum) field names of a model, as derived from the Prisma
+     * DMMF at bootstrap. Relations are excluded.
+     *
+     * Used by the GraphQL generic resolver to fetch the model's own columns even
+     * when a query only selects a subset, so that a custom `@ResolveField` on the
+     * model type (e.g. a signed-URL transform) can read its source column from
+     * `@Parent()`. ABAC field omission still runs afterward at select-time, so a
+     * `@Role`-restricted column is never actually fetched — callers only ever get
+     * the readable projection.
+     *
+     * @param modelName - The model name (any casing; matched case-insensitively).
+     * @returns The model's scalar field names, or `[]` if the model is unknown.
+     */
+    getScalarFields(modelName) {
+        return this.fieldConfigs[modelName.toLowerCase()]?.scalarFields ?? [];
+    }
     /**
      * Retrieves the list of fields to omit based on the user's role.
      * It checks the field configurations stored in `fieldConfigs` and compares them against the role.

package/docs/graphql.md

@@ -162,6 +162,68 @@ Always let the generated resolver serve the data — a custom resolver that reac
 
 ---
 
+## Shaping read output (transforms & computed fields)
+
+To transform a field on the way out (sign a stored S3 key into a URL, mask a value, format a date) or to add a computed field (`slug`, `fullName`), attach a field resolver to the generated model type in the model's module:
+
+```ts
+// src/modules/project/project.fields.ts
+import { Parent, ResolveField, Resolver } from '@nestjs/graphql';
+import { FieldRequires } from '@appxdigital/appx-core';
+import { Project } from '../../generated/project/project.model';
+import { UrlSigner } from '../../shared/url-signer.service';
+
+@Resolver(() => Project)
+export class ProjectFields {
+  constructor(private readonly urls: UrlSigner) {}
+
+  // transform an existing field in place — same name, same type
+  @ResolveField(() => String, { name: 'coverKey', nullable: true })
+  coverKey(@Parent() p: Project) {
+    return p.coverKey ? this.urls.sign(p.coverKey) : null;   // stored key → signed URL
+  }
+
+  // add a computed field — declare the column(s) it reads
+  @ResolveField(() => String, { nullable: true })
+  @FieldRequires('name')
+  slug(@Parent() p: Project) {
+    return p.name ? p.name.toLowerCase().replace(/\s+/g, '-') : null;
+  }
+}
+```
+```ts
+// project.module.ts
+providers: [ProjectService, ProjectResolver, ProjectFields]
+```
+
+The resolver runs wherever the model appears, including nested — `project { find { coverKey } }` and `projectMember { find { project { coverKey } } }` both return the transformed value.
+
+It reads from the already-filtered parent row, so it only ever sees columns the caller's role may read. A field computed from a `@Role`-restricted column receives that column as absent, so a transform cannot surface a value the role can't read.
+
+### `@FieldRequires` — declare a computed field's source columns
+
+A computed field reads columns from its parent, but the query fetches only the columns the client selected. Declare the columns the field reads so they are fetched even when the client didn't select them:
+
+```ts
+@ResolveField(() => String, { nullable: true })
+@FieldRequires('coverKey')                  // one column
+coverUrl(@Parent() p: Project) { … }
+
+@ResolveField(() => String, { nullable: true })
+@FieldRequires(['firstName', 'lastName'])   // a list, or @FieldRequires('firstName', 'lastName')
+fullName(@Parent() p: Project) { … }
+```
+
+- **Declared** → only those columns are fetched for the field.
+- **Not declared** → all of the model's scalar columns are fetched, so the field can read any of them from its parent.
+- **In-place transform** (a resolver reusing an existing field's name) → needs no declaration; that column is fetched whenever the client selects the field.
+
+Read from `@Parent()`, not the raw Prisma client — re-querying bypasses ABAC. For key-to-URL transforms, reuse the existing field's name so the raw stored value never leaves the server.
+
+> The REST CRUD endpoints return rows as stored; output shaping applies to the GraphQL read API.
+
+---
+
 ## Not available yet
 
 - **Mutations** (create/update/delete) — use REST.

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@appxdigital/appx-core",
-    "version": "0.1.128-beta.3",
+    "version": "0.1.128-beta.4",
     "description": "Appx Core is a library that provides a set of tools to help you build your application faster.",
     "main": "dist/index.js",
     "types": "dist/index.d.ts",