@cedarjs/internal 4.0.0 → 4.0.1-next.67

package/dist/generate/gqlormSchema.js

@@ -1,8 +1,29 @@
 import fs from "node:fs";
 import path from "node:path";
-import { getPaths, getPrismaSchemas } from "@cedarjs/project-config";
-const INTERNAL_MODEL_NAMES = /* @__PURE__ */ new Set(["RW_DataMigration"]);
-const SENSITIVE_PATTERNS = ["password", "secret", "token", "hash", "salt"];
+import { getConfig, getPaths, getPrismaSchemas } from "@cedarjs/project-config";
+import { pluralize } from "@cedarjs/utils/cedarPluralize";
+const INTERNAL_MODEL_NAMES = /* @__PURE__ */ new Set([
+  "RW_DataMigration",
+  "Cedar_DataMigration"
+]);
+const SENSITIVE_PATTERNS = [
+  "password",
+  "secret",
+  "token",
+  "hash",
+  "salt",
+  "apikey",
+  "secretkey",
+  "encryptionkey",
+  "privatekey"
+];
+const DEFAULT_GQLORM_BACKEND_CONFIG = {
+  membershipModel: "Membership",
+  membershipModelCamel: "membership",
+  membershipUserField: "userId",
+  membershipOrganizationField: "organizationId",
+  membershipModelExists: false
+};
 function hasDirective(doc, directive) {
   if (!doc) {
     return false;
@@ -22,6 +43,172 @@ function emitSensitivityWarning(modelName, fieldName) {
 `
   );
 }
+const DMMF_TYPE_TO_GRAPHQL = {
+  String: "String",
+  Int: "Int",
+  Float: "Float",
+  BigInt: "BigInt",
+  Boolean: "Boolean",
+  DateTime: "DateTime",
+  Json: "JSON",
+  Decimal: "String",
+  Bytes: "String"
+};
+function mapDmmfTypeToGraphql(type, kind) {
+  if (kind === "enum") {
+    return "String";
+  }
+  return DMMF_TYPE_TO_GRAPHQL[type] ?? "String";
+}
+function graphqlTypeToTsType(graphqlType) {
+  switch (graphqlType) {
+    case "Int":
+    case "Float":
+    case "BigInt":
+      return "number";
+    case "Boolean":
+      return "boolean";
+    default:
+      return "string";
+  }
+}
+function graphqlTypeToTsInterfaceType(graphqlType, isRequired) {
+  let tsType;
+  switch (graphqlType) {
+    case "Int":
+    case "Float":
+    case "BigInt":
+      tsType = "number";
+      break;
+    case "Boolean":
+      tsType = "boolean";
+      break;
+    case "DateTime":
+      tsType = "Date";
+      break;
+    default:
+      tsType = "string";
+  }
+  return isRequired ? tsType : `${tsType} | null`;
+}
+function dmmfTypeToFrontendTsType(type, kind, isRequired) {
+  let tsType;
+  if (kind === "enum") {
+    tsType = "string";
+  } else {
+    switch (type) {
+      case "String":
+        tsType = "string";
+        break;
+      case "Int":
+      case "Float":
+        tsType = "number";
+        break;
+      case "BigInt":
+        tsType = "bigint";
+        break;
+      case "Boolean":
+        tsType = "boolean";
+        break;
+      case "DateTime":
+        tsType = "string";
+        break;
+      case "Json":
+        tsType = "unknown";
+        break;
+      case "Bytes":
+      case "Decimal":
+        tsType = "string";
+        break;
+      default:
+        tsType = "unknown";
+    }
+  }
+  if (isRequired) {
+    return tsType;
+  }
+  return `${tsType} | null`;
+}
+function buildFrontendModelInfo(dmmf) {
+  const models = [];
+  for (const model of dmmf.datamodel.models) {
+    if (INTERNAL_MODEL_NAMES.has(model.name)) {
+      continue;
+    }
+    if (hasDirective(model.documentation, "hide")) {
+      continue;
+    }
+    const fields = [];
+    for (const field of model.fields) {
+      if (field.kind !== "scalar" && field.kind !== "enum") {
+        continue;
+      }
+      if (hasDirective(field.documentation, "hide")) {
+        continue;
+      }
+      const isShown = hasDirective(field.documentation, "show");
+      if (!isShown && isSensitiveField(field.name)) {
+        continue;
+      }
+      fields.push({
+        name: field.name,
+        tsType: dmmfTypeToFrontendTsType(
+          field.type,
+          field.kind,
+          field.isRequired
+        )
+      });
+    }
+    if (fields.length > 0) {
+      models.push({
+        modelName: model.name,
+        camelName: model.name.charAt(0).toLowerCase() + model.name.slice(1),
+        fields
+      });
+    }
+  }
+  return models;
+}
+function generateWebGqlormModelsContent(models) {
+  if (models.length === 0) {
+    return [
+      "// Auto-generated by Cedar \u2014 do not edit",
+      "// Regenerated on every codegen run. Source: api/db/schema.prisma",
+      "",
+      "declare module '@cedarjs/gqlorm/types/orm' {",
+      "  interface GqlormTypeMap {}",
+      "}",
+      ""
+    ].join("\n");
+  }
+  const lines = [
+    "// Auto-generated by Cedar \u2014 do not edit",
+    "// Regenerated on every codegen run. Source: api/db/schema.prisma",
+    "",
+    "declare namespace GqlormScalar {"
+  ];
+  for (const model of models) {
+    lines.push(`  interface ${model.modelName} {`);
+    for (const field of model.fields) {
+      lines.push(`    ${field.name}: ${field.tsType}`);
+    }
+    lines.push("  }");
+    lines.push("");
+  }
+  lines.push("}");
+  lines.push("");
+  lines.push("declare module '@cedarjs/gqlorm/types/orm' {");
+  lines.push("  interface GqlormTypeMap {");
+  lines.push("    models: {");
+  for (const model of models) {
+    lines.push(`      ${model.camelName}: GqlormScalar.${model.modelName}`);
+  }
+  lines.push("    }");
+  lines.push("  }");
+  lines.push("}");
+  lines.push("");
+  return lines.join("\n");
+}
 function buildModelSchema(dmmf) {
   const schema = {};
   for (const model of dmmf.datamodel.models) {
@@ -56,7 +243,368 @@ function buildModelSchema(dmmf) {
   }
   return schema;
 }
+function buildBackendModelInfo(dmmf) {
+  const models = [];
+  for (const model of dmmf.datamodel.models) {
+    if (INTERNAL_MODEL_NAMES.has(model.name)) {
+      continue;
+    }
+    if (hasDirective(model.documentation, "hide")) {
+      continue;
+    }
+    const fields = [];
+    for (const field of model.fields) {
+      if (field.kind !== "scalar" && field.kind !== "enum") {
+        continue;
+      }
+      if (hasDirective(field.documentation, "hide")) {
+        continue;
+      }
+      const isShown = hasDirective(field.documentation, "show");
+      if (!isShown && isSensitiveField(field.name)) {
+        continue;
+      }
+      fields.push({
+        name: field.name,
+        graphqlType: mapDmmfTypeToGraphql(field.type, field.kind),
+        isRequired: field.isRequired,
+        isId: field.isId
+      });
+    }
+    if (fields.length > 0) {
+      const camelName = model.name.charAt(0).toLowerCase() + model.name.slice(1);
+      const pluralName = pluralize(camelName);
+      models.push({
+        modelName: model.name,
+        camelName,
+        pluralName,
+        fields,
+        idField: fields.find((f) => f.isId)
+      });
+    }
+  }
+  return models;
+}
+const TYPE_DEF_REGEX = /\btype\s+([A-Z]\w*)\s*\{/g;
+const STRUCTURAL_TYPE_NAMES = /* @__PURE__ */ new Set(["Query", "Mutation", "Subscription"]);
+function getExistingSdlTypeNames(graphqlDir) {
+  const typeNames = /* @__PURE__ */ new Set();
+  if (!fs.existsSync(graphqlDir)) {
+    return typeNames;
+  }
+  const sdlFiles = fs.readdirSync(graphqlDir).filter((file) => {
+    return /\.sdl\.(ts|js)$/.test(file) && !file.startsWith("__gqlorm__");
+  });
+  for (const file of sdlFiles) {
+    const content = fs.readFileSync(path.join(graphqlDir, file), "utf-8");
+    let match;
+    TYPE_DEF_REGEX.lastIndex = 0;
+    while ((match = TYPE_DEF_REGEX.exec(content)) !== null) {
+      const name = match[1];
+      if (!STRUCTURAL_TYPE_NAMES.has(name)) {
+        typeNames.add(name);
+      }
+    }
+  }
+  return typeNames;
+}
+function generateGqlormBackendContent(models, config = DEFAULT_GQLORM_BACKEND_CONFIG) {
+  if (models.length === 0) {
+    return "";
+  }
+  const anyModelNeedsOrgScoping = config.membershipModelExists && models.some(
+    (m) => m.camelName !== config.membershipModelCamel && m.fields.some((f) => f.name === config.membershipOrganizationField)
+  );
+  const anyModelNeedsAuth = models.some((m) => {
+    const hasUserField = m.fields.some(
+      (f) => f.name === config.membershipUserField
+    );
+    const hasOrgField = m.fields.some(
+      (f) => f.name === config.membershipOrganizationField
+    );
+    const isMembership = m.camelName === config.membershipModelCamel;
+    return hasUserField || hasOrgField && config.membershipModelExists && !isMembership;
+  });
+  const lines = [
+    "// This file is auto-generated by Cedar gqlorm codegen.",
+    "// Do not edit \u2014 it will be overwritten on every codegen run.",
+    "// To hide a model from gqlorm, add /// @gqlorm hide in schema.prisma.",
+    "",
+    "import gql from 'graphql-tag'",
+    ...anyModelNeedsAuth ? [
+      "import { AuthenticationError, ForbiddenError } from '@cedarjs/graphql-server'"
+    ] : [],
+    "",
+    "// Minimal context type used in auth checks",
+    "interface GqlormContext {",
+    "  currentUser: Record<string, unknown> | null | undefined",
+    "}",
+    "",
+    "// Generated minimal interface \u2014 only visible models and fields, only the",
+    "// operations used by this file. No @gqlorm hide models, no sensitive fields.",
+    "// Scoped to avoid any dependency on the generated Prisma client path or",
+    "// @prisma/client (which is an empty shim in Prisma v7).",
+    "interface GqlormDb {"
+  ];
+  for (const model of models) {
+    const selectType = model.fields.map((f) => `${f.name}: true`).join("; ");
+    lines.push(`  ${model.camelName}: {`);
+    lines.push("    findMany(args: {");
+    lines.push("      where?: Record<string, unknown>");
+    lines.push(`      select: Partial<{ ${selectType} }>`);
+    lines.push("    }): Promise<");
+    lines.push("      Array<{");
+    for (const field of model.fields) {
+      const tsType = graphqlTypeToTsInterfaceType(
+        field.graphqlType,
+        field.isRequired
+      );
+      lines.push(`        ${field.name}: ${tsType}`);
+    }
+    lines.push("      }>");
+    lines.push("    >");
+    if (model.idField) {
+      const idTsType = graphqlTypeToTsType(model.idField.graphqlType);
+      lines.push("    findUnique(args: {");
+      lines.push(`      where: { ${model.idField.name}: ${idTsType} }`);
+      lines.push(`      select: { ${selectType} }`);
+      lines.push("    }): Promise<{");
+      for (const field of model.fields) {
+        const tsType = graphqlTypeToTsInterfaceType(
+          field.graphqlType,
+          field.isRequired
+        );
+        lines.push(`      ${field.name}: ${tsType}`);
+      }
+      lines.push("    } | null>");
+    }
+    if (anyModelNeedsOrgScoping && model.camelName === config.membershipModelCamel) {
+      lines.push("    findFirst(args: {");
+      lines.push("      where: Record<string, unknown>");
+      lines.push("    }): Promise<Record<string, unknown> | null>");
+    }
+    lines.push("  }");
+  }
+  const membershipAlreadyInModels = models.some(
+    (m) => m.camelName === config.membershipModelCamel
+  );
+  if (anyModelNeedsOrgScoping && !membershipAlreadyInModels) {
+    lines.push(`  ${config.membershipModelCamel}: {`);
+    lines.push("    findMany(args: {");
+    lines.push("      where: Record<string, unknown>");
+    lines.push(`      select: { ${config.membershipOrganizationField}: true }`);
+    lines.push("    }): Promise<");
+    lines.push(
+      `      Array<{ ${config.membershipOrganizationField}: unknown }>`
+    );
+    lines.push("    >");
+    lines.push("    findFirst(args: {");
+    lines.push("      where: Record<string, unknown>");
+    lines.push("    }): Promise<Record<string, unknown> | null>");
+    lines.push("  }");
+  }
+  lines.push("}");
+  lines.push("");
+  lines.push("export const schema = gql`");
+  for (const model of models) {
+    lines.push(`  type ${model.modelName} {`);
+    for (const field of model.fields) {
+      const nullMark = field.isRequired ? "!" : "";
+      lines.push(`    ${field.name}: ${field.graphqlType}${nullMark}`);
+    }
+    lines.push("  }");
+    lines.push("");
+  }
+  lines.push("  type Query {");
+  for (const model of models) {
+    const hasUserField = model.fields.some(
+      (f) => f.name === config.membershipUserField
+    );
+    const hasOrgField = model.fields.some(
+      (f) => f.name === config.membershipOrganizationField
+    );
+    const isMembershipModel = model.camelName === config.membershipModelCamel;
+    const needsAuth = hasUserField || hasOrgField && config.membershipModelExists && !isMembershipModel;
+    const authDirective = needsAuth ? "@requireAuth" : "@skipAuth";
+    lines.push(
+      `    ${model.pluralName}: [${model.modelName}!]! ${authDirective}`
+    );
+    if (model.idField) {
+      const idNullMark = model.idField.isRequired ? "!" : "";
+      lines.push(
+        `    ${model.camelName}(${model.idField.name}: ${model.idField.graphqlType}${idNullMark}): ${model.modelName} ${authDirective}`
+      );
+    }
+  }
+  lines.push("  }");
+  lines.push("`");
+  lines.push("");
+  lines.push(
+    "// db is passed in from graphql.ts by the Babel inject plugin, which imports it"
+  );
+  lines.push(
+    "// from 'src/lib/db' in a context where that alias resolves correctly."
+  );
+  lines.push("export function createGqlormResolvers(db: GqlormDb) {");
+  lines.push("  return {");
+  lines.push("    Query: {");
+  for (let i = 0; i < models.length; i++) {
+    const model = models[i];
+    const selectObj = model.fields.map((f) => `${f.name}: true`).join(", ");
+    const hasUserField = model.fields.some(
+      (f) => f.name === config.membershipUserField
+    );
+    const hasOrgField = model.fields.some(
+      (f) => f.name === config.membershipOrganizationField
+    );
+    const isMembershipModel = model.camelName === config.membershipModelCamel;
+    const useOrgScoping = hasOrgField && config.membershipModelExists && !isMembershipModel;
+    lines.push(
+      `      ${model.pluralName}: async (_root: unknown, _args: unknown, ${hasUserField || useOrgScoping ? "context" : "_context"}: GqlormContext) => {`
+    );
+    if (hasUserField || useOrgScoping) {
+      lines.push("        if (!context.currentUser) {");
+      lines.push(
+        `          throw new AuthenticationError("You don't have permission to do that.")`
+      );
+      lines.push("        }");
+      lines.push("        const currentUserId = context.currentUser['id']");
+      lines.push(
+        "        if (currentUserId === undefined || currentUserId === null) {"
+      );
+      lines.push(
+        `          throw new AuthenticationError("Could not determine the current user's ID.")`
+      );
+      lines.push("        }");
+      lines.push("        const where: Record<string, unknown> = {}");
+      if (hasUserField) {
+        lines.push("        // Scope to the current user");
+        lines.push(
+          `        where['${config.membershipUserField}'] = currentUserId`
+        );
+      }
+      if (useOrgScoping) {
+        lines.push("        // Scope to the current user's organizations");
+        lines.push(
+          `        const memberships = await db.${config.membershipModelCamel}.findMany({`
+        );
+        lines.push(
+          `          where: { ${config.membershipUserField}: currentUserId },`
+        );
+        lines.push(
+          `          select: { ${config.membershipOrganizationField}: true },`
+        );
+        lines.push("        })");
+        lines.push(
+          `        const organizationIds = memberships.map((m) => m.${config.membershipOrganizationField})`
+        );
+        lines.push(
+          `        where['${config.membershipOrganizationField}'] = { in: organizationIds }`
+        );
+      }
+      lines.push(`        return db.${model.camelName}.findMany({`);
+      lines.push("          where,");
+      lines.push(`          select: { ${selectObj} },`);
+      lines.push("        })");
+    } else {
+      lines.push(`        return db.${model.camelName}.findMany({`);
+      lines.push(`          select: { ${selectObj} },`);
+      lines.push("        })");
+    }
+    lines.push("      },");
+    if (model.idField) {
+      const idFieldName = model.idField.name;
+      const tsType = graphqlTypeToTsType(model.idField.graphqlType);
+      lines.push(
+        `      ${model.camelName}: async (_root: unknown, { ${idFieldName} }: { ${idFieldName}: ${tsType} }, ${hasUserField || useOrgScoping ? "context" : "_context"}: GqlormContext) => {`
+      );
+      if (hasUserField || useOrgScoping) {
+        lines.push("        if (!context.currentUser) {");
+        lines.push(
+          `          throw new AuthenticationError("You don't have permission to do that.")`
+        );
+        lines.push("        }");
+        lines.push("        const currentUserId = context.currentUser['id']");
+        lines.push(
+          "        if (currentUserId === undefined || currentUserId === null) {"
+        );
+        lines.push(
+          `          throw new AuthenticationError("Could not determine the current user's ID.")`
+        );
+        lines.push("        }");
+      }
+      lines.push("");
+      lines.push(
+        `        const record = await db.${model.camelName}.findUnique({`
+      );
+      lines.push(`          where: { ${idFieldName} },`);
+      lines.push(`          select: { ${selectObj} },`);
+      lines.push("        })");
+      lines.push("");
+      lines.push("        if (!record) {");
+      lines.push("          return null");
+      lines.push("        }");
+      if (hasUserField) {
+        lines.push("");
+        lines.push("        // Verify the current user owns this record");
+        lines.push(
+          `        if (record.${config.membershipUserField} !== currentUserId) {`
+        );
+        lines.push(
+          `          throw new ForbiddenError('Not authorized to access this resource')`
+        );
+        lines.push("        }");
+      }
+      if (useOrgScoping) {
+        lines.push("");
+        lines.push(
+          "        // Verify the current user belongs to the record's organization"
+        );
+        lines.push(
+          `        const membership = await db.${config.membershipModelCamel}.findFirst({`
+        );
+        lines.push("          where: {");
+        lines.push(`            ${config.membershipUserField}: currentUserId,`);
+        lines.push(
+          `            ${config.membershipOrganizationField}: record.${config.membershipOrganizationField},`
+        );
+        lines.push("          },");
+        lines.push("        })");
+        lines.push("        if (!membership) {");
+        lines.push(
+          `          throw new ForbiddenError('Not authorized to access this resource')`
+        );
+        lines.push("        }");
+      }
+      lines.push("");
+      lines.push("        return record");
+      lines.push("      },");
+    }
+    if (i < models.length - 1) {
+      lines.push("");
+    }
+  }
+  lines.push("    },");
+  lines.push("  }");
+  lines.push("}");
+  lines.push("");
+  return lines.join("\n");
+}
 async function generateGqlormArtifacts() {
+  if (!getConfig().experimental?.gqlorm?.enabled) {
+    const generatedBase = getPaths().generated.base;
+    const staleFiles = [
+      path.join(generatedBase, "gqlorm", "backend.ts"),
+      path.join(generatedBase, "gqlorm-schema.json"),
+      path.join(generatedBase, "types", "includes", "web-gqlorm-models.d.ts")
+    ];
+    for (const staleFile of staleFiles) {
+      if (fs.existsSync(staleFile)) {
+        fs.unlinkSync(staleFile);
+      }
+    }
+    return { files: [], errors: [] };
+  }
   const files = [];
   const errors = [];
   try {
@@ -64,14 +612,70 @@ async function generateGqlormArtifacts() {
     const mod = await import("@prisma/internals");
     const { getDMMF } = mod.default || mod;
     const dmmf = await getDMMF({ datamodel: schemas });
+    const paths = getPaths();
+    const generatedBase = paths.generated.base;
     const modelSchema = buildModelSchema(dmmf);
-    const outputPath = path.join(
-      getPaths().generated.base,
-      "gqlorm-schema.json"
+    const frontendModels = buildFrontendModelInfo(dmmf);
+    const schemaOutputPath = path.join(generatedBase, "gqlorm-schema.json");
+    const webTypesOutputPath = path.join(
+      generatedBase,
+      "types",
+      "includes",
+      "web-gqlorm-models.d.ts"
+    );
+    fs.mkdirSync(path.dirname(schemaOutputPath), { recursive: true });
+    fs.writeFileSync(schemaOutputPath, JSON.stringify(modelSchema, null, 2));
+    files.push(schemaOutputPath);
+    fs.mkdirSync(path.dirname(webTypesOutputPath), { recursive: true });
+    fs.writeFileSync(
+      webTypesOutputPath,
+      generateWebGqlormModelsContent(frontendModels)
     );
-    fs.mkdirSync(path.dirname(outputPath), { recursive: true });
-    fs.writeFileSync(outputPath, JSON.stringify(modelSchema, null, 2));
-    files.push(outputPath);
+    files.push(webTypesOutputPath);
+    const backendOutputDir = path.join(generatedBase, "gqlorm");
+    const backendOutputPath = path.join(backendOutputDir, "backend.ts");
+    const graphqlDir = paths.api.graphql;
+    const existingTypes = getExistingSdlTypeNames(graphqlDir);
+    const allModels = buildBackendModelInfo(dmmf);
+    const gqlormConfig = getConfig().experimental.gqlorm;
+    const membershipModel = gqlormConfig.membershipModel ?? "Membership";
+    const membershipModelCamel = membershipModel.charAt(0).toLowerCase() + membershipModel.slice(1);
+    const membershipUserField = gqlormConfig.membershipUserField ?? "userId";
+    const membershipOrganizationField = gqlormConfig.membershipOrganizationField ?? "organizationId";
+    const membershipModelExists = dmmf.datamodel.models.some(
+      (m) => m.name === membershipModel
+    );
+    const backendConfig = {
+      membershipModel,
+      membershipModelCamel,
+      membershipUserField,
+      membershipOrganizationField,
+      membershipModelExists
+    };
+    const gqlormModels = allModels.filter(
+      (m) => !existingTypes.has(m.modelName)
+    );
+    const anyModelHasOrgField = gqlormModels.some(
+      (m) => m.fields.some((f) => f.name === membershipOrganizationField)
+    );
+    if (anyModelHasOrgField && !membershipModelExists) {
+      console.warn(
+        `[gqlorm] One or more models have a \`${membershipOrganizationField}\` field, but the membership model "${membershipModel}" was not found in the schema. Organization-based access scoping will not be applied for these models. Add a \`${membershipModel}\` model to your schema.prisma or configure \`experimental.gqlorm.membershipModel\` in cedar.toml.`
+      );
+    }
+    if (gqlormModels.length > 0) {
+      const backendContent = generateGqlormBackendContent(
+        gqlormModels,
+        backendConfig
+      );
+      fs.mkdirSync(backendOutputDir, { recursive: true });
+      fs.writeFileSync(backendOutputPath, backendContent);
+      files.push(backendOutputPath);
+    } else {
+      if (fs.existsSync(backendOutputPath)) {
+        fs.unlinkSync(backendOutputPath);
+      }
+    }
   } catch (error) {
     errors.push({
       message: "Failed to generate gqlorm schema artifacts",
@@ -81,6 +685,12 @@ async function generateGqlormArtifacts() {
   return { files, errors };
 }
 export {
+  buildBackendModelInfo,
+  buildFrontendModelInfo,
   buildModelSchema,
-  generateGqlormArtifacts
+  generateGqlormArtifacts,
+  generateGqlormBackendContent,
+  generateWebGqlormModelsContent,
+  getExistingSdlTypeNames,
+  mapDmmfTypeToGraphql
 };