@model-ts/graphql 7.2.0 → 7.3.0

package/CHANGELOG.md

@@ -1,5 +1,13 @@
 # @model-ts/graphql
 
+## 7.3.0
+
+### Minor Changes
+
+- ce187d1: Add `where` to models, unions and `DynamoDB`: a pipe step that keeps a loaded item only when a predicate holds. After `load`, a rejected item fails with `ItemNotFoundError` for its key; after `loadOption` or any read of an `Option`, it becomes `Option.none()`.
+
+  Add `publicMessages` to `withErrorPolicy`: a public error with a fixed message reaches clients as only that message and its code, without its own message or declared fields.
+
 ## 7.2.0
 
 ## 7.1.0

package/README.md

@@ -1057,6 +1057,7 @@ Choose the public error code exposed to clients:
 `examples/error-policy.ts`
 
 ```ts
+import { ItemNotFoundError } from "@model-ts/dynamodb"
 import { createBuilder, ErrorReporter } from "@model-ts/graphql"
 import { Cause, Effect, Layer, Schema } from "effect"
 import type { AppContext, Types } from "../api/graphql.ts"
@@ -1065,8 +1066,12 @@ class AccessDenied extends Schema.TaggedError<AccessDenied>()("AccessDenied", {
   message: Schema.String,
 }) {}
 export const GraphQL = createBuilder<Types, AppContext>().withErrorPolicy({
-  public: [AccessDenied],
-  publicCodes: { AccessDenied: "ACCESS_DENIED" },
+  public: [AccessDenied, ItemNotFoundError],
+  publicCodes: {
+    AccessDenied: "ACCESS_DENIED",
+    ItemNotFoundError: "NOT_FOUND",
+  },
+  publicMessages: { ItemNotFoundError: "Not found" },
 })
 export const Reporting = Layer.succeed(ErrorReporter, {
   report: ({ cause, coordinate, phase }) =>
@@ -1087,6 +1092,14 @@ arbitrary thrown exception does not make it public. This policy also applies to
 custom scalar callbacks and abstract-type resolution. Ordinary graphql-js
 document diagnostics remain available to clients.
 
+Some errors are safe to report but carry fields that are not, such as the
+storage key of an `ItemNotFoundError`. Give their tag a fixed message in
+`publicMessages`: clients then get only that message and the error's code, here
+`{ message: "Not found", extensions: { code: "NOT_FOUND" } }`, and never the
+error's own message or fields. The keys must be tags of the `public` errors. A
+field that lists the error in its `errors` union still returns it as a union
+member with its declared fields.
+
 Provide `Reporting` alongside the application's service layers, for example with
 `Layer.mergeAll(Sandbox.layerMemory(), Reporting)`. The optional `ErrorReporter`
 receives the original Effect cause, field coordinate, and phase for masked