@avytrix/nestjs-drizzle-crud 3.8.0 → 3.8.2

package/AGENT.md

@@ -151,6 +151,8 @@ Those are legacy manual patterns and they break registration.
 `withCount: false` it skips the count, `total` is `null` and `hasMore` is set.
 `delete` and `softDelete` return a boolean. `update` and `restore` return the entity and
 throw `EntityNotFoundException` when the row is missing.
+Writes turn an ISO string or a number for a date-mode `timestamp` / `date` /
+`datetime` column into a `Date`; a value that is not a date is a 400 naming the column.
 
 Every method takes `options`: `{ transaction, relations, select, search, hooks, lock, forNoKeyUpdate, withDeleted, onlyDeleted, skipAllowlists, bulkMode, counts, context, skipScope, skipEvents, expectedVersion, expectedVersions }`.
 
@@ -395,7 +397,9 @@ restore, force delete, attach included) and written onto every created row, so
 another tenant's id is a 404. A missing context value is a 403, never an
 unscoped query. A belongs-to key a write sets must point at a row of the
 caller's tenant when the related table has the scope columns; another tenant's
-row is the same 400 as a missing one. Do not add `tenant_id` to filters or DTOs
+row is the same 400 as a missing one. Nested create children get the same check
+for the keys their nested relation declares in its own `relations`; declare
+every belongs-to a child can set. Do not add `tenant_id` to filters or DTOs
 by hand, and use `skipScope: true` only in trusted server code.
 
 # Optimistic locking

package/CHANGELOG.md

@@ -11,6 +11,114 @@ restore, `ER_DUP_ENTRY` mapping, dialect locking) are tracked separately and unc
 3.3.1, 3.4.0, 3.5.0 and 3.5.2 were tagged but never published to npm. Their changes reached npm
 in 3.5.1 (3.3.1 to 3.5.0) and 3.6.0 (3.5.2). The unscoped `nestjs-drizzle-crud` stops at 3.3.0.
 
+## [3.8.2] - 2026-11-04
+
+Fixes from the 3.8.1 audit (G-01 to G-08). The tenant key check now lets the database compare keys,
+so it follows each column's collation, and a malformed key or an ISO date string in a write body is
+no longer a 500. No public API or override point changed, and no operation sends more statements
+than in 3.8.1.
+
+### Changed
+
+- The tenant key check, `attach` and `sync` leave the key comparison to the database. They join the
+  keys they were sent, as an inline `VALUES` list, against the related table in the same scoped
+  `SELECT`, so the column's type and collation decide which key matched. A `citext` or SQLite
+  `NOCASE` key of the caller's own tenant in another case is accepted again (3.8.1 refused it with
+  a 400), and on MySQL a key under a `_bin` collation that differs from another tenant's only in
+  case is refused. PostgreSQL `text` still compares exactly, and a uuid matches in any case. On
+  MySQL an integer or decimal key is compared in its column's type, so a `BIGINT` past 2^53 is
+  matched exactly. `attach` and `sync` link each target by its key as stored, so `"ann@x.io"` and
+  `"Ann@X.io"` on a `citext` column give one link.
+- `massUpdate` and `massUpsert` load `relations` and `counts` inside their transaction when a value
+  holds a Drizzle `sql` expression. A load that fails then rolls the write back, so a retry no
+  longer adds `views + 1` twice.
+- A `RangeError` thrown while a statement's values are mapped (a custom type's own check, say) is
+  no longer reported as "Too many values in one statement". Only the call stack overflow of an
+  oversized parameter list is.
+
+### Fixed
+
+- A belongs-to key the column's type cannot hold (`"nope"` for a uuid) is a 400 in `massCreate`,
+  `massUpdate` and `massUpsert`, and in `update` inside a caller's transaction. It was a raw
+  `22P02` or `25P02`, a 500.
+- Every write (`create`, `update`, `upsert`, the mass writes and nested rows) turns an ISO date
+  string or a number for a date-mode `timestamp`, `date` or `datetime` column into a `Date`, as
+  filters already did. It was a 500 `TypeError` (`value.toISOString is not a function`). A value
+  that is not a date, an Invalid Date included, is a 400 that names the column, in a write and in a
+  filter.
+- `massUpdate` groups SETs by their raw values: a hook that returns `null` for one id and an
+  Invalid Date for another no longer gets both into one `UPDATE`. A `Date` and its ISO string are
+  two values, and byte arrays compare by their bytes.
+- A `massUpdate` whose SETs all hold the same `sql` expression object, as in
+  ``massUpdate(ids, { n: sql`n + 1` })``, sends one `UPDATE` instead of one per id.
+- The per-call scope memo ends with the public call that started it. Options a hook kept and passed
+  to a later call reused the old memo, which grew with each call and resolved a context object
+  mutated in place to its old tenant.
+
+### Docs
+
+- The 3.8.1 entry now says the 404 ahead of a refused value holds outside a caller's transaction,
+  and that a mass write with an SQL value was not safe to retry. The bulk operations page says when
+  such a write loads its relations and that one shared `sql` object is one `UPDATE`.
+- The multi-tenancy page says the database compares the keys. The CRUD operations page, the README
+  and `AGENT.md` say date strings are parsed on writes.
+
+## [3.8.1] - 2026-11-04
+
+Fixes from the 3.8.0 audit (D-01 to D-11). Three of them close gaps in tenant isolation: a scope
+handed from one service to another, a batch key that differs from another tenant's only in case,
+and nested children that skipped the key check. No public API or override point changed.
+
+### Changed
+
+- Text keys compare exactly in the tenant key check, `attach` and `sync`: `"US"` and `"us"` are
+  two keys, as they are two rows on PostgreSQL and SQLite. Before, every key was lowercased, so a
+  batch holding both could point a row at another tenant's `"us"` and get a 201 where `"us"`
+  alone was a 400. A uuid column still ignores case, and so does MySQL, to follow its default
+  collations, which match `"us"` to a stored `"US"` and cannot hold both as distinct keys.
+- On a scoped entity, a nested create checks the belongs-to keys of the rows it writes (a
+  belongs-to parent, has-many children, new many-to-many targets) against the caller's tenant,
+  using the nested relation's own `relations`. A child key to another tenant's row is the same
+  400 `ForeignKeyViolationException` as a key to a missing row, and nothing is written. It was a
+  201. A child key that no nested relation declares is still left to the database's foreign key.
+- `massSoftDelete` and `massDelete` put `deleted_at IS NULL` in the `WHERE` of their write, as the
+  single-row writes have since 3.8.0. A row soft-deleted between the existence check and the
+  write is a 404 entry and the batch writes nothing, instead of being stamped again or
+  hard-deleted. `massForceDelete` still removes a row in either state.
+- `massCreate` loads `relations` and `counts` inside its transaction again. A load that fails
+  rolls the rows back, so a retry no longer stores them twice. The other mass writes still load
+  after the commit, where a retry gives the same rows, except for a write whose values hold an SQL
+  expression (``massUpdate(ids, { views: sql`views + 1` })``), which 3.8.2 loads inside too.
+- `update` of a missing row with a value the database refuses (`update(999, { views: "abc" })`)
+  is a 404, as it was before 3.8.0, instead of a 400, outside a caller's transaction. Inside one
+  (`options.transaction`) the failed statement has aborted the transaction on PostgreSQL, so the
+  answer stays the 400, which is the same for every tenant.
+
+### Fixed
+
+- The per-call scope memo is keyed by service and by the context it was resolved for. Options
+  handed from one service to another, the natural way for a subclass override to share a
+  transaction, carried the first service's scope: a service whose scope is `null` let a scoped
+  one read every tenant's rows, and a second service scoped by another column stored `NULL` in
+  it. Each service still runs its scope function once per call.
+- An override of `emitEvent` or `prepareUpdate` keeps the guard read ahead of the write, like an
+  override of a `before*` hook. An `emitEvent` override saw the before event for another
+  tenant's id before the 404.
+- `massUpdate` with a `beforeUpdate` hook that returns `NaN` for one id and `null` for another no
+  longer writes `NaN` to both, and a Drizzle `sql` expression as a value (`views + 1`) works as
+  it does in `update` instead of failing with a circular `TypeError` (a 500).
+- The tenant key check sends its `SELECT`s, one per relation, together instead of one after the
+  other.
+
+### Docs
+
+- The multi-tenancy FAQ answered "No" to "Are eager-loaded relations filtered by tenant?", against
+  the section on the same page. It now says yes, when the related table has the scope columns.
+  The multi-tenancy and relations-on-writes pages say which nested keys are checked, and the bulk
+  operations page says when a mass write loads its relations.
+- `AGENTS.md`, `CONTRIBUTING.md` and `apps/docs/AGENTS.md` point at the changelog page where it
+  lives now, `(support)/changelog.mdx`.
+
 ## [3.8.0] - 2026-11-03
 
 Performance fixes from the 3.7.1 performance report. Calls return the same rows, in the same

package/README.md

@@ -445,6 +445,10 @@ export class UsersService extends SqlBaseCrudService<User, CreateUserDto, Update
 | `detach(id, relation, ids?, options?)` | `Promise<T>` | Unlink some, or all when `ids` is left out. |
 | `sync(id, relation, ids, options?)` | `Promise<T>` | Make the links exactly `ids`. |
 
+Every write turns an ISO string or a number for a date-mode `timestamp`, `date`
+or `datetime` column into a `Date`, so a JSON body needs no transforming DTO for
+it. A value that is not a date is a 400 that names the column.
+
 ### Bulk (run inside a transaction)
 
 | Method | Returns |

package/dist/core/abstract/sql-base-crud.service.d.ts

@@ -21,12 +21,15 @@ export declare abstract class SqlBaseCrudService<T extends Record<string, any>,
     protected primaryKeyOf(table: any): string;
     protected isTextColumn(column: any): boolean;
     protected coerceFilterValue(column: any, value: any): any;
+    private toDate;
+    private coerceDates;
     private static readonly ALLOWLIST_LABELS;
     protected assertAllowed(list: keyof CrudAllowlists, path: string, options?: SqlOperationOptions): void;
     protected checkReadOptions(options?: SqlOperationOptions): void;
     protected rowScope(options?: SqlOperationOptions): any[];
     protected resolveScope(options?: SqlOperationOptions): CrudScopeValues | null;
     private withScopeMemo;
+    private scopedCall;
     private checkScope;
     protected scopeConditions(options?: SqlOperationOptions, table?: any): any[];
     protected relatedRowScope(target: any, options?: SqlOperationOptions): any[];
@@ -178,6 +181,7 @@ export declare abstract class SqlBaseCrudService<T extends Record<string, any>,
     private keysOutsideScope;
     private assertBatchKeysInScope;
     private assertKeysInScope;
+    private assertNestedKeysInScope;
     private missingParentException;
     private linkTargets;
     attach(id: any, relation: string, relatedIds: unknown[], options?: SqlOperationOptions): Promise<T>;
@@ -185,7 +189,11 @@ export declare abstract class SqlBaseCrudService<T extends Record<string, any>,
     sync(id: any, relation: string, relatedIds: unknown[], options?: SqlOperationOptions): Promise<T>;
     private changeLinks;
     private valueKey;
-    private uniqueValues;
+    private distinct;
+    private matchKeys;
+    private keyInput;
+    private mysqlKeyCast;
+    private pgKeyType;
     private tableName;
     protected prepareUpdate(data: UpdateDto, options?: SqlOperationOptions): Record<string, any>;
     update(id: any, data: UpdateDto, options?: SqlOperationOptions): Promise<T>;
@@ -218,6 +226,7 @@ export declare abstract class SqlBaseCrudService<T extends Record<string, any>,
     massRestore(ids: any[], options?: SqlOperationOptions): Promise<T[]>;
     massDelete(ids: any[], options?: SqlOperationOptions): Promise<boolean>;
     massForceDelete(ids: any[], options?: SqlOperationOptions): Promise<boolean>;
+    private holdsSql;
     private uniqueIds;
     private fingerprint;
     private assertAllExist;