@drzl/cli 4.37.0 → 4.38.0

package/dist/cli.js

@@ -30,13 +30,14 @@ import {
   nestjsOutDir,
   nextOutDir,
   openApiFetchOutDir,
+  pothosOutDir,
   seedOutDir,
   tableAliases,
   tableFilterWarnings,
   tanstackStartOutDir,
   trpcOutDir,
   tsRestOutDir
-} from "./chunk-EQ4OSVMJ.js";
+} from "./chunk-VG6SD2GP.js";
 
 // src/cli.ts
 import { qualifiedTableName as qualifiedTableName2, SchemaAnalyzer as SchemaAnalyzer2 } from "@drzl/analyzer";
@@ -531,6 +532,17 @@ function fastCheckOptions(g, cfg) {
   };
 }
 
+// src/pothos-options.ts
+function pothosOptions(g, cfg) {
+  return {
+    outputDir: pothosOutDir(g, cfg),
+    naming: g.naming,
+    outputHeader: g.outputHeader,
+    format: g.format,
+    importExtension: g.importExtension
+  };
+}
+
 // src/h3-options.ts
 var VALIDATOR_DEFAULT_DIRS6 = {
   zod: "src/validators/zod",
@@ -893,6 +905,14 @@ var GENERATORS = [
     outputDir: (g, cfg) => fastCheckOutDir(g, cfg),
     options: (g, cfg) => fastCheckOptions(g, cfg)
   },
+  {
+    kind: "pothos",
+    specifier: "@drzl/generator-pothos",
+    load: () => import("@drzl/generator-pothos"),
+    construct: (m, analysis) => new m.PothosGenerator(analysis),
+    outputDir: (g, cfg) => pothosOutDir(g, cfg),
+    options: (g, cfg) => pothosOptions(g, cfg)
+  },
   {
     kind: "service",
     specifier: "@drzl/generator-service",
@@ -1136,6 +1156,101 @@ import { parseCheck as parseCheck2 } from "@drzl/validation-core";
 
 // src/doctor.ts
 import { lengthMeasure, parseCheck } from "@drzl/validation-core";
+
+// src/auth-tables.ts
+var SIGNATURES = [
+  {
+    model: "account",
+    // `providerId` beside `accountId` is the distinctive pair: it is a link to an external identity
+    // provider, which an application table has no reason to model this way.
+    required: ["accountId", "providerId", "userId"],
+    supporting: ["accessToken", "refreshToken", "idToken", "password", "scope"],
+    conventionalName: "account",
+    secrets: ["accessToken", "refreshToken", "idToken", "password"]
+  },
+  {
+    model: "session",
+    required: ["token", "expiresAt", "userId"],
+    supporting: ["ipAddress", "userAgent"],
+    conventionalName: "session",
+    // A session token is a bearer credential: whoever reads it is that user until it expires.
+    secrets: ["token"]
+  },
+  {
+    model: "verification",
+    // `identifier` and `value` are deliberately generic names, which is why `expiresAt` is required
+    // too: the three together are a short-lived token store and little else.
+    required: ["identifier", "value", "expiresAt"],
+    supporting: [],
+    conventionalName: "verification",
+    secrets: ["value"]
+  },
+  {
+    model: "user",
+    required: ["email", "emailVerified"],
+    supporting: ["name", "image"],
+    conventionalName: "user",
+    secrets: []
+  }
+];
+function columnKeys(table) {
+  const out = /* @__PURE__ */ new Map();
+  for (const c of table.columns) out.set(normalise(c.name), c);
+  return out;
+}
+function normalise(name) {
+  return name.replace(/[_-]/g, "").toLowerCase();
+}
+function has(keys, name) {
+  return keys.has(normalise(name));
+}
+function actualName(table, wanted) {
+  return table.columns.find((c) => normalise(c.name) === normalise(wanted))?.name;
+}
+function matchOne(table, sig) {
+  const keys = columnKeys(table);
+  const missing = sig.required.filter((r) => !has(keys, r));
+  if (missing.length) return void 0;
+  const supporting = sig.supporting.filter((s) => has(keys, s));
+  const nameMatches = normalise(table.name) === normalise(sig.conventionalName) || normalise(table.name) === `${normalise(sig.conventionalName)}s`;
+  const confidence = supporting.length > 0 || nameMatches ? "strong" : "likely";
+  const matched = [...sig.required, ...supporting].map((c) => actualName(table, c)).filter((c) => Boolean(c));
+  const secrets = sig.secrets.map((c) => actualName(table, c)).filter((c) => Boolean(c));
+  return { table: table.name, model: sig.model, confidence, matched, secrets };
+}
+function detectAuthTables(analysis) {
+  const found = [];
+  for (const table of analysis.tables) {
+    for (const sig of SIGNATURES) {
+      const m = matchOne(table, sig);
+      if (m) {
+        found.push(m);
+        break;
+      }
+    }
+  }
+  const hasNonUser = found.some((f) => f.model !== "user");
+  return hasNonUser ? found : found.filter((f) => f.model !== "user");
+}
+function authTablesWithSecrets(matches) {
+  return matches.filter((m) => m.secrets.length > 0);
+}
+function excludeSuggestion(matches) {
+  const names = [...new Set(matches.map((m) => m.table))].sort();
+  return `exclude: [${names.map((n) => `'${n}'`).join(", ")}]`;
+}
+function authTableWarnings(analysis) {
+  const risky = authTablesWithSecrets(detectAuthTables(analysis));
+  if (!risky.length) return [];
+  const lines = risky.map(
+    (m) => `"${m.table}" looks like an authentication library's ${m.model} table and holds ${m.secrets.map((c) => `"${c}"`).join(", ")}. Generating for it publishes ${m.secrets.length === 1 ? "that column" : "those columns"}.`
+  );
+  return [
+    `drzl generate: ${lines.join(" ")} Keep ${risky.length === 1 ? "it" : "them"} out with ${excludeSuggestion(risky)}, or leave it if the route is deliberate.`
+  ];
+}
+
+// src/doctor.ts
 import { Chalk as Chalk2 } from "chalk";
 var PLAIN = new Chalk2({ level: 0 });
 var HANDLED_CODES = /* @__PURE__ */ new Set(["DRZL_ANL_UNKNOWN_COLUMN"]);
@@ -1308,6 +1423,18 @@ function buildDoctorReport(analysis, schemaPath) {
       hint: i.hint
     });
   }
+  for (const match of detectAuthTables(analysis)) {
+    const secrets = match.secrets.length ? ` It holds ${match.secrets.map((c) => `\`${c}\``).join(", ")}, which a generated read route would return to whoever calls it.` : "";
+    findings.push({
+      kind: "auth-table",
+      // A warning rather than an error: this is a real leak and it is also a guess about someone
+      // else's schema, and a doctor that failed the build on a guess would be switched off.
+      level: "warn",
+      table: match.table,
+      message: `"${match.table}" matches the shape of an authentication library's ${match.model} table (${match.matched.join(", ")}).${secrets}`,
+      hint: `Keep it out of every generator with ${excludeSuggestion([match])}.`
+    });
+  }
   for (const i of analysis.issues) {
     if (i.code !== "DRZL_ANL_UNKNOWN_COLUMN") continue;
     findings.push({
@@ -1346,6 +1473,11 @@ var SECTIONS = [
     title: "Columns DRZL cannot type",
     why: "These get a validator that accepts any value."
   },
+  {
+    kinds: ["auth-table"],
+    title: "Tables that look like an authentication library's",
+    why: "Every generator loops over every table it finds, so these get routes too."
+  },
   {
     kinds: ["check-declined", "check-unknown-column", "check-not-scalar", "check-uncountable"],
     title: "CHECK constraints DRZL does not enforce",
@@ -3925,6 +4057,7 @@ withOutputFlags(
       analysis.tables = filterTables(narrowed.tables, cfg);
       for (const w of [...narrowed.warnings, ...filterWarnings]) warn(w);
       for (const w of wideColumnWarning(analysis.issues)) warn(w);
+      for (const w of authTableWarnings(analysis)) warn(w);
       const empty = nothingToGenerate({
         schema: source.schema,
         analyzed: narrowed.tables,