@loradb/lora-graphql 0.24.0 → 0.24.1

package/README.md

@@ -809,12 +809,18 @@ type Post
 - **Anonymous callers.** Without a token every rule denies, unless the
   schema says `@authorizationDefaults(requireAuthentication: false)`. Then
   a rule with a branch that reads no claims decides that branch for
-  anonymous callers too (the published posts above), while a rule that
-  needs claims still asks for a token: `UNAUTHENTICATED`, not `FORBIDDEN`.
-  It is one setting for the schema; a rule has no such field. To keep a
-  claim-free branch for signed-in callers, test a claim beside it
+  anonymous callers too (the published posts above). A rule that needs
+  claims still denies them, and how depends on the kind of rule: a
+  validate rule asks for a token (`UNAUTHENTICATED`, not `FORBIDDEN`),
+  while a READ filter admits no row, so a signed-out caller reads an
+  empty list and the access matrix calls it `denied`.
+  It is one setting for the schema; a rule has no such field, and it
+  reaches every rule: a CREATE, UPDATE, DELETE or CONNECT rule that
+  reads no claims decides for signed-out callers as well. `check` names
+  each such write rule that no `@authentication` covers. To keep a
+  claim-free rule or branch for signed-in callers, test a claim beside it
   (`{ jwt: { sub: { exists: true } } }`, as the tenant rule above does),
-  or put `@authentication` on the type.
+  or put `@authentication` on the type or the relationship field.
 - **The caller's own node.** Mark the claim that identifies the caller
   with `@viewer(type: "Person", field: "subject")` (the field is `@key` or
   `@unique`), so the key can stay a slug while the subject is an identity
@@ -1445,18 +1451,29 @@ the rules test, such as `roles:admin`), with the verdict (`allowed`,
 rules that decide it. When rules name the caller's node (`isViewer`),
 `viewer` is the caller on nodes that are theirs: every rule part that
 only names them passes, so it shows the most a related caller gets,
-where `authenticated` shows what any signed-in caller gets. A
+where `authenticated` shows what any signed-in caller gets. A part under
+`NOT` stays as written and is decided per row, so `viewer` never reads
+below `authenticated`. A relationship field has a CONNECT row when a
+rule or `@authentication(operations: [CREATE_RELATIONSHIP])` guards it,
+and a DISCONNECT row for a rule or `DELETE_RELATIONSHIP`. A
 `@key(scope: VIEWER)` type's CREATE reads
 `unauthenticated` for anonymous callers and `validated` by `key scope`
 for the rest.
 
-`lora.operationAccess(document | persistedId, operationName?)` answers
-the same question for one operation: each root field (fragments
+`lora.operationAccess(document | persistedId, operationName?, variables?)`
+answers the same question for one operation: each root field (fragments
 followed) with its type, the operations it needs (an upsert needs
 `CREATE` and `UPDATE`) and the verdict per caller, plus the most
 restrictive verdict per caller over all root fields. A field over
 several types (`node`, a union) reports the most restrictive member.
-Root fields only: nested selections answer to their own types' rules.
+A mutation's inputs are read for what they write through relationship
+fields: a nested connect or create counts as that field's CONNECT (and
+the target's CREATE), a disconnect or nested delete as its DISCONNECT, an
+`update: { edge }` as UPDATE_EDGE, each named in `by`
+(`Room.chan CONNECT: @authentication`). Pass `variables` for inputs the
+document takes as variables; a variable without a value is not read and
+is listed in the field's `unresolved`. Selections below a root field
+answer to their own types' READ rules.
 To keep admin-only operations out of client bundles:
 
 ````ts
@@ -1470,9 +1487,15 @@ order is stable, so a snapshot in CI turns access changes into diffs.
 `check` lints authorization too:
 
 - a filter rule every signed-in caller passes;
-- a rule with a branch that needs no claims, in a schema that leaves
+- a rule that needs no claims, as a whole or in one `OR` branch, on a
+  type or a field, in a schema that leaves
   `@authorizationDefaults(requireAuthentication:)` unset: anonymous
-  callers are refused that branch by default, so say which was meant;
+  callers are refused it by default, so say which was meant;
+- once that setting is `false`, each write rule (CREATE, UPDATE, DELETE,
+  CONNECT, DISCONNECT, UPDATE_EDGE) a signed-out caller can pass and no
+  `@authentication` covers. READ rules and operations the type lists in
+  `public` are left alone: those are what the setting and the list are
+  for;
 - field rules the schema's bypass skips, on a type that says neither
   `@authorization(bypass: false)` nor `bypass: true`, and one line naming
   every type with rules the bypass reaches that way (plus relationship

package/dist/analyze/access.d.ts

@@ -23,6 +23,11 @@ export interface RootFieldAccess {
         verdict: AccessVerdict;
         by: string[];
     }>;
+    /**
+     * Variables in the field's arguments that were given no value: what
+     * they would write through relationship fields is not in `access`.
+     */
+    unresolved?: string[];
 }
 export interface OperationAccess {
     operation: "query" | "mutation" | "subscription";
@@ -39,9 +44,12 @@ export interface OperationAccess {
 }
 /**
  * Who may run `operation`: each root field's verdict per principal, read
- * off the same rules as `accessMatrix`. Root fields only: nested
- * selections answer to their own types' READ rules (see the matrix).
+ * off the same rules as `accessMatrix`. A mutation's inputs are read for
+ * the relationship writes they make, each a part of its root field's
+ * verdict; an input given as a variable is read when `variables` has its
+ * value and listed in `unresolved` when it does not. Selections below a
+ * root field answer to their own types' READ rules (see the matrix).
  */
-export declare function operationAccess(model: GraphModel, schema: GraphQLSchema, operation: OperationDefinitionNode, fragments: ReadonlyMap<string, FragmentDefinitionNode>): OperationAccess;
+export declare function operationAccess(model: GraphModel, schema: GraphQLSchema, operation: OperationDefinitionNode, fragments: ReadonlyMap<string, FragmentDefinitionNode>, variables?: Readonly<Record<string, unknown>>): OperationAccess;
 /** The access matrix of `model`, in a stable order. */
 export declare function accessMatrix(model: GraphModel, schema: GraphQLSchema): AccessEntry[];

package/dist/analyze/verdicts.d.ts

@@ -42,4 +42,10 @@ export declare function fieldVerdict(ctx: CompileContext, node: NodeType, field:
     kind: string;
     authorization?: NodeType["authorization"];
 }): Pick<AccessEntry, "verdict" | "by">;
+/**
+ * The `@authentication` operation a relationship operation answers to: a
+ * connect is checked as CREATE_RELATIONSHIP on the field, a disconnect as
+ * DELETE_RELATIONSHIP. Edge reads and updates have none of their own.
+ */
+export declare function relationshipAuthentication(op: RelationshipOperation): AuthOperation | undefined;
 export declare function relationshipVerdict(ctx: CompileContext, node: NodeType, field: Parameters<typeof relationshipRules>[1], op: RelationshipOperation): Pick<AccessEntry, "verdict" | "by">;

package/dist/cli.js

@@ -3,8 +3,8 @@ import { execFileSync as re } from "node:child_process";
 import { stat as M, readFile as ce, readdir as ue, mkdir as le, writeFile as _ } from "node:fs/promises";
 import { dirname as fe, basename as de, join as O, relative as pe } from "node:path";
 import { parse as j, Kind as p, visit as Y, print as Z, typeFromAST as me, isNonNullType as G, isListType as he, getNamedType as ge, isEnumType as ve, isInputObjectType as we } from "graphql";
-import { d as Ee } from "./diff-aDivqYqr.js";
-import { q as K, e as be, M as Te, a as R, l as X, g as x, u as ee, c as Ne, i as ye, r as Se, w as Ie } from "./driver-DSnytFsU.js";
+import { d as Ee } from "./diff-K8-GSeKH.js";
+import { q as K, e as be, M as Te, a as R, l as X, g as x, u as ee, c as Ne, i as ye, r as Se, w as Ie } from "./driver-CXKPLfkz.js";
 const $e = /* @__PURE__ */ new Set(["Query", "Mutation", "Subscription"]), W = {
   coalesce: "@coalesce is not supported: it hides predicates from indexes; store a value instead",
   subscriptionsAuthorization: "@subscriptionsAuthorization is not supported: SUBSCRIBE rules go in @authorization",

package/dist/{diff-aDivqYqr.js → diff-K8-GSeKH.js}

@@ -1,5 +1,5 @@
 import * as w from "graphql";
-import { c as $, i as v, r as E, m as N, n as i, o as S } from "./driver-DSnytFsU.js";
+import { c as $, i as v, r as E, m as N, n as i, o as S } from "./driver-CXKPLfkz.js";
 function k(t, n, o = {}) {
   const s = $(t, o), r = $(n, o), l = N, u = new Map(v(s).map((e) => [l(e), e])), c = new Map(v(r).map((e) => [l(e), e])), p = [...c].filter(([e]) => !u.has(e)).map(([, e]) => e), m = [...u].filter(([e]) => !c.has(e)).map(([, e]) => e), d = [], f = [];
   C(s, r, d, f);
@@ -97,4 +97,4 @@ function M(t, n) {
 export {
   k as d
 };
-//# sourceMappingURL=diff-aDivqYqr.js.map
+//# sourceMappingURL=diff-K8-GSeKH.js.map

package/dist/{diff-aDivqYqr.js.map → diff-K8-GSeKH.js.map}

@@ -1 +1 @@
-{"version":3,"file":"diff-aDivqYqr.js","sources":["../src/analyze/diff.ts"],"sourcesContent":["// S7: one SDL, two diffs. A change to the annotated SDL changes both the\n// database (constraints, indexes, labels, property names) and the public\n// API; `diffSchemas` reports both from the same two documents.\n\nimport * as graphql from \"graphql\";\nimport type { DocumentNode, GraphQLSchema } from \"graphql\";\nimport { name } from \"../compile/cypher.js\";\nimport { buildModel } from \"../model/build.js\";\nimport { type ModelOptions } from \"../model/build/limits.js\";\nimport type { Field, GraphModel, ScalarField } from \"../model/types.js\";\nimport { buildSchema } from \"../schema/build.js\";\nimport {\n  inferRequirements,\n  requirementDdl,\n  requirementId,\n  type SchemaRequirement,\n} from \"./indexes.js\";\n\nexport interface ApiChange {\n  /** graphql-js change type, e.g. `FIELD_REMOVED`. */\n  type: string;\n  description: string;\n}\n\nexport interface SchemaDiff {\n  database: {\n    create: SchemaRequirement[];\n    drop: SchemaRequirement[];\n    /**\n     * Statements in the order to run them. Drops and data migrations are\n     * destructive: review them before running.\n     */\n    statements: Array<{ text: string; destructive: boolean; reason: string }>;\n  };\n  api: {\n    /** Changes that break existing clients. */\n    breaking: ApiChange[];\n    /** Changes that may change behaviour for existing clients. */\n    dangerous: ApiChange[];\n  };\n  /** Consequences worth a human look, e.g. a rename kept by @alias. */\n  notes: string[];\n}\n\nexport function diffSchemas(\n  before: string | DocumentNode,\n  after: string | DocumentNode,\n  options: ModelOptions = {},\n): SchemaDiff {\n  const oldModel = buildModel(before, options);\n  const newModel = buildModel(after, options);\n\n  const id = requirementId;\n  const oldReqs = new Map(inferRequirements(oldModel).map((r) => [id(r), r]));\n  const newReqs = new Map(inferRequirements(newModel).map((r) => [id(r), r]));\n  const create = [...newReqs]\n    .filter(([k]) => !oldReqs.has(k))\n    .map(([, r]) => r);\n  const drop = [...oldReqs].filter(([k]) => !newReqs.has(k)).map(([, r]) => r);\n\n  const statements: SchemaDiff[\"database\"][\"statements\"] = [];\n  const notes: string[] = [];\n  migrations(oldModel, newModel, statements, notes);\n  for (const r of drop) {\n    statements.push({\n      text: `DROP ${r.kind === \"constraint\" ? \"CONSTRAINT\" : \"INDEX\"} \\`${r.name.replace(/`/g, \"``\")}\\` IF EXISTS`,\n      destructive: true,\n      reason: `no longer needed: ${r.reason}`,\n    });\n  }\n  for (const r of create) {\n    statements.push({\n      text: requirementDdl(r),\n      destructive: false,\n      reason: r.reason,\n    });\n  }\n\n  const api = apiChanges(publicSchema(oldModel), publicSchema(newModel));\n  return { database: { create, drop, statements }, api, notes };\n}\n\n/** Relabelled types and renamed properties need their data moved. */\nfunction migrations(\n  before: GraphModel,\n  after: GraphModel,\n  statements: SchemaDiff[\"database\"][\"statements\"],\n  notes: string[],\n) {\n  for (const [typeName, oldNode] of before.nodes) {\n    const newNode = after.nodes.get(typeName);\n    if (!newNode) {\n      notes.push(\n        `${typeName} was removed; its :${oldNode.labels[0]} nodes stay in the database`,\n      );\n      continue;\n    }\n    const oldLabel = oldNode.labels[0]!;\n    const newLabel = newNode.labels[0]!;\n    if (oldLabel !== newLabel) {\n      statements.push({\n        text: `MATCH (n:${name(oldLabel)}) SET n:${name(newLabel)} REMOVE n:${name(oldLabel)}`,\n        destructive: true,\n        reason: `${typeName}'s label changed from ${oldLabel} to ${newLabel}`,\n      });\n    }\n    const oldFields = scalars(oldNode.fields);\n    const newFields = scalars(newNode.fields);\n    for (const [fieldName, oldField] of oldFields) {\n      const newField = newFields.get(fieldName);\n      if (newField && newField.property !== oldField.property) {\n        statements.push({\n          text: `MATCH (n:${name(newLabel)}) WHERE n.${name(oldField.property)} IS NOT NULL SET n.${name(newField.property)} = n.${name(oldField.property)} REMOVE n.${name(oldField.property)}`,\n          destructive: true,\n          reason: `${typeName}.${fieldName} now stores \\`${newField.property}\\` instead of \\`${oldField.property}\\``,\n        });\n      }\n      if (!newField) {\n        const renamed = [...newFields.values()].find(\n          (f) => f.property === oldField.property && !oldFields.has(f.name),\n        );\n        if (renamed) {\n          notes.push(\n            `${typeName}.${fieldName} is now ${typeName}.${renamed.name} over the same property \\`${oldField.property}\\`: an API break with no data migration`,\n          );\n        }\n      }\n    }\n  }\n}\n\nfunction scalars(fields: ReadonlyMap<string, Field>): Map<string, ScalarField> {\n  const out = new Map<string, ScalarField>();\n  for (const f of fields.values()) if (f.kind === \"scalar\") out.set(f.name, f);\n  return out;\n}\n\nfunction publicSchema(model: GraphModel): GraphQLSchema {\n  const never = () => Promise.reject(new Error(\"not connected\"));\n  return buildSchema(model, {\n    customResolver: () => () => null,\n    resolveSearch: never,\n    resolveAbstract: never,\n    subscribe: () => {\n      throw new Error(\"not connected\");\n    },\n    resolveChangedNode: never,\n    previousValue: () => null,\n    resolveRoot: never,\n    resolveNode: never,\n    resolveCypher: never,\n    resolveMutation: never,\n  });\n}\n\ntype ChangeFinder = (\n  a: GraphQLSchema,\n  b: GraphQLSchema,\n) => Array<{ type: string; description: string }>;\n\nfunction apiChanges(\n  before: GraphQLSchema,\n  after: GraphQLSchema,\n): SchemaDiff[\"api\"] {\n  // graphql-js 16 ships these; 17 removed them.\n  const lib = graphql as unknown as {\n    findBreakingChanges?: ChangeFinder;\n    findDangerousChanges?: ChangeFinder;\n  };\n  if (!lib.findBreakingChanges || !lib.findDangerousChanges) {\n    return {\n      breaking: [\n        {\n          type: \"UNSUPPORTED\",\n          description:\n            \"this graphql version has no findBreakingChanges; compare printPublicSchema() output with @graphql-inspector/core\",\n        },\n      ],\n      dangerous: [],\n    };\n  }\n  const pick = (c: { type: string; description: string }) => ({\n    type: c.type,\n    description: c.description,\n  });\n  return {\n    breaking: lib.findBreakingChanges(before, after).map(pick),\n    dangerous: lib.findDangerousChanges(before, after).map(pick),\n  };\n}\n"],"names":["diffSchemas","before","after","options","oldModel","buildModel","newModel","id","requirementId","oldReqs","inferRequirements","r","newReqs","create","k","drop","statements","notes","migrations","requirementDdl","api","apiChanges","publicSchema","typeName","oldNode","newNode","oldLabel","newLabel","name","oldFields","scalars","newFields","fieldName","oldField","newField","renamed","f","fields","out","model","never","buildSchema","lib","graphql","pick","c"],"mappings":";;AA4CO,SAASA,EACdC,GACAC,GACAC,IAAwB,CAAA,GACZ;AACZ,QAAMC,IAAWC,EAAWJ,GAAQE,CAAO,GACrCG,IAAWD,EAAWH,GAAOC,CAAO,GAEpCI,IAAKC,GACLC,IAAU,IAAI,IAAIC,EAAkBN,CAAQ,EAAE,IAAI,CAACO,MAAM,CAACJ,EAAGI,CAAC,GAAGA,CAAC,CAAC,CAAC,GACpEC,IAAU,IAAI,IAAIF,EAAkBJ,CAAQ,EAAE,IAAI,CAACK,MAAM,CAACJ,EAAGI,CAAC,GAAGA,CAAC,CAAC,CAAC,GACpEE,IAAS,CAAC,GAAGD,CAAO,EACvB,OAAO,CAAC,CAACE,CAAC,MAAM,CAACL,EAAQ,IAAIK,CAAC,CAAC,EAC/B,IAAI,CAAC,CAAA,EAAGH,CAAC,MAAMA,CAAC,GACbI,IAAO,CAAC,GAAGN,CAAO,EAAE,OAAO,CAAC,CAACK,CAAC,MAAM,CAACF,EAAQ,IAAIE,CAAC,CAAC,EAAE,IAAI,CAAC,CAAA,EAAGH,CAAC,MAAMA,CAAC,GAErEK,IAAmD,CAAA,GACnDC,IAAkB,CAAA;AACxB,EAAAC,EAAWd,GAAUE,GAAUU,GAAYC,CAAK;AAChD,aAAWN,KAAKI;AACd,IAAAC,EAAW,KAAK;AAAA,MACd,MAAM,QAAQL,EAAE,SAAS,eAAe,eAAe,OAAO,MAAMA,EAAE,KAAK,QAAQ,MAAM,IAAI,CAAC;AAAA,MAC9F,aAAa;AAAA,MACb,QAAQ,qBAAqBA,EAAE,MAAM;AAAA,IAAA,CACtC;AAEH,aAAWA,KAAKE;AACd,IAAAG,EAAW,KAAK;AAAA,MACd,MAAMG,EAAeR,CAAC;AAAA,MACtB,aAAa;AAAA,MACb,QAAQA,EAAE;AAAA,IAAA,CACX;AAGH,QAAMS,IAAMC,EAAWC,EAAalB,CAAQ,GAAGkB,EAAahB,CAAQ,CAAC;AACrE,SAAO,EAAE,UAAU,EAAE,QAAAO,GAAQ,MAAAE,GAAM,YAAAC,EAAA,GAAc,KAAAI,GAAK,OAAAH,EAAA;AACxD;AAGA,SAASC,EACPjB,GACAC,GACAc,GACAC,GACA;AACA,aAAW,CAACM,GAAUC,CAAO,KAAKvB,EAAO,OAAO;AAC9C,UAAMwB,IAAUvB,EAAM,MAAM,IAAIqB,CAAQ;AACxC,QAAI,CAACE,GAAS;AACZ,MAAAR,EAAM;AAAA,QACJ,GAAGM,CAAQ,sBAAsBC,EAAQ,OAAO,CAAC,CAAC;AAAA,MAAA;AAEpD;AAAA,IACF;AACA,UAAME,IAAWF,EAAQ,OAAO,CAAC,GAC3BG,IAAWF,EAAQ,OAAO,CAAC;AACjC,IAAIC,MAAaC,KACfX,EAAW,KAAK;AAAA,MACd,MAAM,YAAYY,EAAKF,CAAQ,CAAC,WAAWE,EAAKD,CAAQ,CAAC,aAAaC,EAAKF,CAAQ,CAAC;AAAA,MACpF,aAAa;AAAA,MACb,QAAQ,GAAGH,CAAQ,yBAAyBG,CAAQ,OAAOC,CAAQ;AAAA,IAAA,CACpE;AAEH,UAAME,IAAYC,EAAQN,EAAQ,MAAM,GAClCO,IAAYD,EAAQL,EAAQ,MAAM;AACxC,eAAW,CAACO,GAAWC,CAAQ,KAAKJ,GAAW;AAC7C,YAAMK,IAAWH,EAAU,IAAIC,CAAS;AAQxC,UAPIE,KAAYA,EAAS,aAAaD,EAAS,YAC7CjB,EAAW,KAAK;AAAA,QACd,MAAM,YAAYY,EAAKD,CAAQ,CAAC,aAAaC,EAAKK,EAAS,QAAQ,CAAC,sBAAsBL,EAAKM,EAAS,QAAQ,CAAC,QAAQN,EAAKK,EAAS,QAAQ,CAAC,aAAaL,EAAKK,EAAS,QAAQ,CAAC;AAAA,QACpL,aAAa;AAAA,QACb,QAAQ,GAAGV,CAAQ,IAAIS,CAAS,iBAAiBE,EAAS,QAAQ,mBAAmBD,EAAS,QAAQ;AAAA,MAAA,CACvG,GAEC,CAACC,GAAU;AACb,cAAMC,IAAU,CAAC,GAAGJ,EAAU,OAAA,CAAQ,EAAE;AAAA,UACtC,CAACK,MAAMA,EAAE,aAAaH,EAAS,YAAY,CAACJ,EAAU,IAAIO,EAAE,IAAI;AAAA,QAAA;AAElE,QAAID,KACFlB,EAAM;AAAA,UACJ,GAAGM,CAAQ,IAAIS,CAAS,WAAWT,CAAQ,IAAIY,EAAQ,IAAI,6BAA6BF,EAAS,QAAQ;AAAA,QAAA;AAAA,MAG/G;AAAA,IACF;AAAA,EACF;AACF;AAEA,SAASH,EAAQO,GAA8D;AAC7E,QAAMC,wBAAU,IAAA;AAChB,aAAWF,KAAKC,EAAO,OAAA,EAAU,CAAID,EAAE,SAAS,YAAUE,EAAI,IAAIF,EAAE,MAAMA,CAAC;AAC3E,SAAOE;AACT;AAEA,SAAShB,EAAaiB,GAAkC;AACtD,QAAMC,IAAQ,MAAM,QAAQ,OAAO,IAAI,MAAM,eAAe,CAAC;AAC7D,SAAOC,EAAYF,GAAO;AAAA,IACxB,gBAAgB,MAAM,MAAM;AAAA,IAC5B,eAAeC;AAAA,IACf,iBAAiBA;AAAA,IACjB,WAAW,MAAM;AACf,YAAM,IAAI,MAAM,eAAe;AAAA,IACjC;AAAA,IACA,oBAAoBA;AAAA,IACpB,eAAe,MAAM;AAAA,IACrB,aAAaA;AAAA,IACb,aAAaA;AAAA,IACb,eAAeA;AAAA,IACf,iBAAiBA;AAAA,EAAA,CAClB;AACH;AAOA,SAASnB,EACPpB,GACAC,GACmB;AAEnB,QAAMwC,IAAMC;AAIZ,MAAI,CAACD,EAAI,uBAAuB,CAACA,EAAI;AACnC,WAAO;AAAA,MACL,UAAU;AAAA,QACR;AAAA,UACE,MAAM;AAAA,UACN,aACE;AAAA,QAAA;AAAA,MACJ;AAAA,MAEF,WAAW,CAAA;AAAA,IAAC;AAGhB,QAAME,IAAO,CAACC,OAA8C;AAAA,IAC1D,MAAMA,EAAE;AAAA,IACR,aAAaA,EAAE;AAAA,EAAA;AAEjB,SAAO;AAAA,IACL,UAAUH,EAAI,oBAAoBzC,GAAQC,CAAK,EAAE,IAAI0C,CAAI;AAAA,IACzD,WAAWF,EAAI,qBAAqBzC,GAAQC,CAAK,EAAE,IAAI0C,CAAI;AAAA,EAAA;AAE/D;"}
+{"version":3,"file":"diff-K8-GSeKH.js","sources":["../src/analyze/diff.ts"],"sourcesContent":["// S7: one SDL, two diffs. A change to the annotated SDL changes both the\n// database (constraints, indexes, labels, property names) and the public\n// API; `diffSchemas` reports both from the same two documents.\n\nimport * as graphql from \"graphql\";\nimport type { DocumentNode, GraphQLSchema } from \"graphql\";\nimport { name } from \"../compile/cypher.js\";\nimport { buildModel } from \"../model/build.js\";\nimport { type ModelOptions } from \"../model/build/limits.js\";\nimport type { Field, GraphModel, ScalarField } from \"../model/types.js\";\nimport { buildSchema } from \"../schema/build.js\";\nimport {\n  inferRequirements,\n  requirementDdl,\n  requirementId,\n  type SchemaRequirement,\n} from \"./indexes.js\";\n\nexport interface ApiChange {\n  /** graphql-js change type, e.g. `FIELD_REMOVED`. */\n  type: string;\n  description: string;\n}\n\nexport interface SchemaDiff {\n  database: {\n    create: SchemaRequirement[];\n    drop: SchemaRequirement[];\n    /**\n     * Statements in the order to run them. Drops and data migrations are\n     * destructive: review them before running.\n     */\n    statements: Array<{ text: string; destructive: boolean; reason: string }>;\n  };\n  api: {\n    /** Changes that break existing clients. */\n    breaking: ApiChange[];\n    /** Changes that may change behaviour for existing clients. */\n    dangerous: ApiChange[];\n  };\n  /** Consequences worth a human look, e.g. a rename kept by @alias. */\n  notes: string[];\n}\n\nexport function diffSchemas(\n  before: string | DocumentNode,\n  after: string | DocumentNode,\n  options: ModelOptions = {},\n): SchemaDiff {\n  const oldModel = buildModel(before, options);\n  const newModel = buildModel(after, options);\n\n  const id = requirementId;\n  const oldReqs = new Map(inferRequirements(oldModel).map((r) => [id(r), r]));\n  const newReqs = new Map(inferRequirements(newModel).map((r) => [id(r), r]));\n  const create = [...newReqs]\n    .filter(([k]) => !oldReqs.has(k))\n    .map(([, r]) => r);\n  const drop = [...oldReqs].filter(([k]) => !newReqs.has(k)).map(([, r]) => r);\n\n  const statements: SchemaDiff[\"database\"][\"statements\"] = [];\n  const notes: string[] = [];\n  migrations(oldModel, newModel, statements, notes);\n  for (const r of drop) {\n    statements.push({\n      text: `DROP ${r.kind === \"constraint\" ? \"CONSTRAINT\" : \"INDEX\"} \\`${r.name.replace(/`/g, \"``\")}\\` IF EXISTS`,\n      destructive: true,\n      reason: `no longer needed: ${r.reason}`,\n    });\n  }\n  for (const r of create) {\n    statements.push({\n      text: requirementDdl(r),\n      destructive: false,\n      reason: r.reason,\n    });\n  }\n\n  const api = apiChanges(publicSchema(oldModel), publicSchema(newModel));\n  return { database: { create, drop, statements }, api, notes };\n}\n\n/** Relabelled types and renamed properties need their data moved. */\nfunction migrations(\n  before: GraphModel,\n  after: GraphModel,\n  statements: SchemaDiff[\"database\"][\"statements\"],\n  notes: string[],\n) {\n  for (const [typeName, oldNode] of before.nodes) {\n    const newNode = after.nodes.get(typeName);\n    if (!newNode) {\n      notes.push(\n        `${typeName} was removed; its :${oldNode.labels[0]} nodes stay in the database`,\n      );\n      continue;\n    }\n    const oldLabel = oldNode.labels[0]!;\n    const newLabel = newNode.labels[0]!;\n    if (oldLabel !== newLabel) {\n      statements.push({\n        text: `MATCH (n:${name(oldLabel)}) SET n:${name(newLabel)} REMOVE n:${name(oldLabel)}`,\n        destructive: true,\n        reason: `${typeName}'s label changed from ${oldLabel} to ${newLabel}`,\n      });\n    }\n    const oldFields = scalars(oldNode.fields);\n    const newFields = scalars(newNode.fields);\n    for (const [fieldName, oldField] of oldFields) {\n      const newField = newFields.get(fieldName);\n      if (newField && newField.property !== oldField.property) {\n        statements.push({\n          text: `MATCH (n:${name(newLabel)}) WHERE n.${name(oldField.property)} IS NOT NULL SET n.${name(newField.property)} = n.${name(oldField.property)} REMOVE n.${name(oldField.property)}`,\n          destructive: true,\n          reason: `${typeName}.${fieldName} now stores \\`${newField.property}\\` instead of \\`${oldField.property}\\``,\n        });\n      }\n      if (!newField) {\n        const renamed = [...newFields.values()].find(\n          (f) => f.property === oldField.property && !oldFields.has(f.name),\n        );\n        if (renamed) {\n          notes.push(\n            `${typeName}.${fieldName} is now ${typeName}.${renamed.name} over the same property \\`${oldField.property}\\`: an API break with no data migration`,\n          );\n        }\n      }\n    }\n  }\n}\n\nfunction scalars(fields: ReadonlyMap<string, Field>): Map<string, ScalarField> {\n  const out = new Map<string, ScalarField>();\n  for (const f of fields.values()) if (f.kind === \"scalar\") out.set(f.name, f);\n  return out;\n}\n\nfunction publicSchema(model: GraphModel): GraphQLSchema {\n  const never = () => Promise.reject(new Error(\"not connected\"));\n  return buildSchema(model, {\n    customResolver: () => () => null,\n    resolveSearch: never,\n    resolveAbstract: never,\n    subscribe: () => {\n      throw new Error(\"not connected\");\n    },\n    resolveChangedNode: never,\n    previousValue: () => null,\n    resolveRoot: never,\n    resolveNode: never,\n    resolveCypher: never,\n    resolveMutation: never,\n  });\n}\n\ntype ChangeFinder = (\n  a: GraphQLSchema,\n  b: GraphQLSchema,\n) => Array<{ type: string; description: string }>;\n\nfunction apiChanges(\n  before: GraphQLSchema,\n  after: GraphQLSchema,\n): SchemaDiff[\"api\"] {\n  // graphql-js 16 ships these; 17 removed them.\n  const lib = graphql as unknown as {\n    findBreakingChanges?: ChangeFinder;\n    findDangerousChanges?: ChangeFinder;\n  };\n  if (!lib.findBreakingChanges || !lib.findDangerousChanges) {\n    return {\n      breaking: [\n        {\n          type: \"UNSUPPORTED\",\n          description:\n            \"this graphql version has no findBreakingChanges; compare printPublicSchema() output with @graphql-inspector/core\",\n        },\n      ],\n      dangerous: [],\n    };\n  }\n  const pick = (c: { type: string; description: string }) => ({\n    type: c.type,\n    description: c.description,\n  });\n  return {\n    breaking: lib.findBreakingChanges(before, after).map(pick),\n    dangerous: lib.findDangerousChanges(before, after).map(pick),\n  };\n}\n"],"names":["diffSchemas","before","after","options","oldModel","buildModel","newModel","id","requirementId","oldReqs","inferRequirements","r","newReqs","create","k","drop","statements","notes","migrations","requirementDdl","api","apiChanges","publicSchema","typeName","oldNode","newNode","oldLabel","newLabel","name","oldFields","scalars","newFields","fieldName","oldField","newField","renamed","f","fields","out","model","never","buildSchema","lib","graphql","pick","c"],"mappings":";;AA4CO,SAASA,EACdC,GACAC,GACAC,IAAwB,CAAA,GACZ;AACZ,QAAMC,IAAWC,EAAWJ,GAAQE,CAAO,GACrCG,IAAWD,EAAWH,GAAOC,CAAO,GAEpCI,IAAKC,GACLC,IAAU,IAAI,IAAIC,EAAkBN,CAAQ,EAAE,IAAI,CAACO,MAAM,CAACJ,EAAGI,CAAC,GAAGA,CAAC,CAAC,CAAC,GACpEC,IAAU,IAAI,IAAIF,EAAkBJ,CAAQ,EAAE,IAAI,CAACK,MAAM,CAACJ,EAAGI,CAAC,GAAGA,CAAC,CAAC,CAAC,GACpEE,IAAS,CAAC,GAAGD,CAAO,EACvB,OAAO,CAAC,CAACE,CAAC,MAAM,CAACL,EAAQ,IAAIK,CAAC,CAAC,EAC/B,IAAI,CAAC,CAAA,EAAGH,CAAC,MAAMA,CAAC,GACbI,IAAO,CAAC,GAAGN,CAAO,EAAE,OAAO,CAAC,CAACK,CAAC,MAAM,CAACF,EAAQ,IAAIE,CAAC,CAAC,EAAE,IAAI,CAAC,CAAA,EAAGH,CAAC,MAAMA,CAAC,GAErEK,IAAmD,CAAA,GACnDC,IAAkB,CAAA;AACxB,EAAAC,EAAWd,GAAUE,GAAUU,GAAYC,CAAK;AAChD,aAAWN,KAAKI;AACd,IAAAC,EAAW,KAAK;AAAA,MACd,MAAM,QAAQL,EAAE,SAAS,eAAe,eAAe,OAAO,MAAMA,EAAE,KAAK,QAAQ,MAAM,IAAI,CAAC;AAAA,MAC9F,aAAa;AAAA,MACb,QAAQ,qBAAqBA,EAAE,MAAM;AAAA,IAAA,CACtC;AAEH,aAAWA,KAAKE;AACd,IAAAG,EAAW,KAAK;AAAA,MACd,MAAMG,EAAeR,CAAC;AAAA,MACtB,aAAa;AAAA,MACb,QAAQA,EAAE;AAAA,IAAA,CACX;AAGH,QAAMS,IAAMC,EAAWC,EAAalB,CAAQ,GAAGkB,EAAahB,CAAQ,CAAC;AACrE,SAAO,EAAE,UAAU,EAAE,QAAAO,GAAQ,MAAAE,GAAM,YAAAC,EAAA,GAAc,KAAAI,GAAK,OAAAH,EAAA;AACxD;AAGA,SAASC,EACPjB,GACAC,GACAc,GACAC,GACA;AACA,aAAW,CAACM,GAAUC,CAAO,KAAKvB,EAAO,OAAO;AAC9C,UAAMwB,IAAUvB,EAAM,MAAM,IAAIqB,CAAQ;AACxC,QAAI,CAACE,GAAS;AACZ,MAAAR,EAAM;AAAA,QACJ,GAAGM,CAAQ,sBAAsBC,EAAQ,OAAO,CAAC,CAAC;AAAA,MAAA;AAEpD;AAAA,IACF;AACA,UAAME,IAAWF,EAAQ,OAAO,CAAC,GAC3BG,IAAWF,EAAQ,OAAO,CAAC;AACjC,IAAIC,MAAaC,KACfX,EAAW,KAAK;AAAA,MACd,MAAM,YAAYY,EAAKF,CAAQ,CAAC,WAAWE,EAAKD,CAAQ,CAAC,aAAaC,EAAKF,CAAQ,CAAC;AAAA,MACpF,aAAa;AAAA,MACb,QAAQ,GAAGH,CAAQ,yBAAyBG,CAAQ,OAAOC,CAAQ;AAAA,IAAA,CACpE;AAEH,UAAME,IAAYC,EAAQN,EAAQ,MAAM,GAClCO,IAAYD,EAAQL,EAAQ,MAAM;AACxC,eAAW,CAACO,GAAWC,CAAQ,KAAKJ,GAAW;AAC7C,YAAMK,IAAWH,EAAU,IAAIC,CAAS;AAQxC,UAPIE,KAAYA,EAAS,aAAaD,EAAS,YAC7CjB,EAAW,KAAK;AAAA,QACd,MAAM,YAAYY,EAAKD,CAAQ,CAAC,aAAaC,EAAKK,EAAS,QAAQ,CAAC,sBAAsBL,EAAKM,EAAS,QAAQ,CAAC,QAAQN,EAAKK,EAAS,QAAQ,CAAC,aAAaL,EAAKK,EAAS,QAAQ,CAAC;AAAA,QACpL,aAAa;AAAA,QACb,QAAQ,GAAGV,CAAQ,IAAIS,CAAS,iBAAiBE,EAAS,QAAQ,mBAAmBD,EAAS,QAAQ;AAAA,MAAA,CACvG,GAEC,CAACC,GAAU;AACb,cAAMC,IAAU,CAAC,GAAGJ,EAAU,OAAA,CAAQ,EAAE;AAAA,UACtC,CAACK,MAAMA,EAAE,aAAaH,EAAS,YAAY,CAACJ,EAAU,IAAIO,EAAE,IAAI;AAAA,QAAA;AAElE,QAAID,KACFlB,EAAM;AAAA,UACJ,GAAGM,CAAQ,IAAIS,CAAS,WAAWT,CAAQ,IAAIY,EAAQ,IAAI,6BAA6BF,EAAS,QAAQ;AAAA,QAAA;AAAA,MAG/G;AAAA,IACF;AAAA,EACF;AACF;AAEA,SAASH,EAAQO,GAA8D;AAC7E,QAAMC,wBAAU,IAAA;AAChB,aAAWF,KAAKC,EAAO,OAAA,EAAU,CAAID,EAAE,SAAS,YAAUE,EAAI,IAAIF,EAAE,MAAMA,CAAC;AAC3E,SAAOE;AACT;AAEA,SAAShB,EAAaiB,GAAkC;AACtD,QAAMC,IAAQ,MAAM,QAAQ,OAAO,IAAI,MAAM,eAAe,CAAC;AAC7D,SAAOC,EAAYF,GAAO;AAAA,IACxB,gBAAgB,MAAM,MAAM;AAAA,IAC5B,eAAeC;AAAA,IACf,iBAAiBA;AAAA,IACjB,WAAW,MAAM;AACf,YAAM,IAAI,MAAM,eAAe;AAAA,IACjC;AAAA,IACA,oBAAoBA;AAAA,IACpB,eAAe,MAAM;AAAA,IACrB,aAAaA;AAAA,IACb,aAAaA;AAAA,IACb,eAAeA;AAAA,IACf,iBAAiBA;AAAA,EAAA,CAClB;AACH;AAOA,SAASnB,EACPpB,GACAC,GACmB;AAEnB,QAAMwC,IAAMC;AAIZ,MAAI,CAACD,EAAI,uBAAuB,CAACA,EAAI;AACnC,WAAO;AAAA,MACL,UAAU;AAAA,QACR;AAAA,UACE,MAAM;AAAA,UACN,aACE;AAAA,QAAA;AAAA,MACJ;AAAA,MAEF,WAAW,CAAA;AAAA,IAAC;AAGhB,QAAME,IAAO,CAACC,OAA8C;AAAA,IAC1D,MAAMA,EAAE;AAAA,IACR,aAAaA,EAAE;AAAA,EAAA;AAEjB,SAAO;AAAA,IACL,UAAUH,EAAI,oBAAoBzC,GAAQC,CAAK,EAAE,IAAI0C,CAAI;AAAA,IACzD,WAAWF,EAAI,qBAAqBzC,GAAQC,CAAK,EAAE,IAAI0C,CAAI;AAAA,EAAA;AAE/D;"}