@nixxie-cms/core 1.0.0

package/src/lib/core/queries/output-field.ts

@@ -0,0 +1,178 @@
+import { type CacheHint, maybeCacheControlFromInfo } from '@apollo/cache-control-types'
+import DataLoader from 'dataloader'
+import type { GraphQLResolveInfo } from 'graphql'
+
+import { g } from '../../..'
+import type {
+  BaseItem,
+  BaseListTypeInfo,
+  FieldAccessControlFunction,
+  FieldReadItemAccessArgs,
+  FindManyArgsValue,
+  NixxieContext,
+  NextFieldType,
+} from '../../../types'
+import { getAccessFilters, getOperationAccess, getOperationFieldAccess } from '../access-control'
+import type { InitialisedList } from '../initialise-lists'
+import type { ResolvedDBField, ResolvedRelationDBField } from '../resolve-relationships'
+import { type IdType, getDBFieldKeyForFieldOnMultiField, weakMemoize } from '../utils'
+import * as queries from './resolvers'
+import { accessControlledFilter } from './resolvers'
+
+function getRelationVal(
+  dbField: ResolvedRelationDBField,
+  id: IdType,
+  foreignList: InitialisedList,
+  context: NixxieContext,
+  info: GraphQLResolveInfo,
+  fk: IdType | null | undefined
+) {
+  const oppositeDbField = foreignList.resolvedDbFields[dbField.field]
+  if (oppositeDbField.kind !== 'relation') throw new Error('failed assert')
+
+  if (dbField.mode === 'many') {
+    const relationFilter = {
+      [dbField.field]: oppositeDbField.mode === 'many' ? { some: { id } } : { id },
+    }
+    return {
+      findMany: async (args: FindManyArgsValue) =>
+        queries.findMany(args, foreignList, context, info, relationFilter),
+      count: async ({ where }: { where: Record<string, unknown> }) =>
+        queries.count({ where }, foreignList, context, info, relationFilter),
+    }
+  } else {
+    return async () => {
+      if (fk === null) {
+        // If the foreign key is explicitly null, there's no need to anything else,
+        // since we know the related item doesn't exist.
+        return null
+      }
+      // for one-to-many relationships, the one side always owns the foreign key
+      // so that means we have the id for the related item and we're fetching it by _its_ id.
+      // for the a one-to-one relationship though, the id might be on the related item
+      // so we need to fetch the related item by the id of the current item on the foreign key field
+      const currentItemOwnsForeignKey = fk !== undefined
+      return fetchRelatedItem(context)(foreignList)(
+        currentItemOwnsForeignKey ? 'id' : `${dbField.field}Id`
+      )(currentItemOwnsForeignKey ? fk : id)
+    }
+  }
+}
+
+function memoize<Arg, Return>(cb: (arg: Arg) => Return) {
+  const cache = new Map<Arg, Return>()
+  return (arg: Arg) => {
+    if (!cache.has(arg)) {
+      const result = cb(arg)
+      cache.set(arg, result)
+    }
+    return cache.get(arg)!
+  }
+}
+
+const fetchRelatedItem = weakMemoize((context: NixxieContext) =>
+  weakMemoize((foreignList: InitialisedList) =>
+    memoize((idFieldKey: string) => {
+      const relatedItemLoader = new DataLoader(
+        (keys: readonly IdType[]) => fetchRelatedItems(context, foreignList, idFieldKey, keys),
+        { cache: false }
+      )
+      return (id: IdType) => relatedItemLoader.load(id)
+    })
+  )
+)
+
+async function fetchRelatedItems(
+  context: NixxieContext,
+  foreignList: InitialisedList,
+  idFieldKey: string,
+  toFetch: readonly IdType[]
+) {
+  const operationAccess = await getOperationAccess(foreignList, context, 'query')
+  if (!operationAccess) {
+    return toFetch.map(() => undefined)
+  }
+
+  const accessFilters = await getAccessFilters(foreignList, context, 'query')
+  if (accessFilters === false) {
+    return toFetch.map(() => undefined)
+  }
+
+  const toFetchUnique = Array.from(new Set(toFetch))
+  const resolvedWhere = await accessControlledFilter(
+    foreignList,
+    context,
+    { [idFieldKey]: { in: toFetchUnique } },
+    accessFilters
+  )
+
+  const results = await context.prisma[foreignList.listKey].findMany({ where: resolvedWhere })
+  const resultsById = new Map(results.map((x: any) => [x[idFieldKey], x]))
+  return toFetch.map(id => resultsById.get(id))
+}
+
+function getValueForDBField(
+  item: BaseItem,
+  dbField: ResolvedDBField,
+  id: IdType,
+  fieldPath: string,
+  context: NixxieContext,
+  lists: Record<string, InitialisedList>,
+  info: GraphQLResolveInfo
+) {
+  if (dbField.kind === 'multi') {
+    return Object.fromEntries(
+      Object.keys(dbField.fields).map(innerDBFieldKey => {
+        const keyOnDbValue = getDBFieldKeyForFieldOnMultiField(fieldPath, innerDBFieldKey)
+        return [innerDBFieldKey, item[keyOnDbValue] as any]
+      })
+    )
+  }
+  if (dbField.kind === 'relation') {
+    // If we're holding a foreign key value, let's take advantage of that.
+    let fk: IdType | undefined
+    if (dbField.mode === 'one' && dbField.foreignIdField.kind !== 'none') {
+      fk = item[`${fieldPath}Id`] as IdType
+    }
+    return getRelationVal(dbField, id, lists[dbField.list], context, info, fk)
+  } else {
+    return item[fieldPath] as any
+  }
+}
+
+export function outputTypeField(
+  output: NextFieldType['output'],
+  dbField: ResolvedDBField,
+  cacheHint: CacheHint | undefined,
+  access: FieldAccessControlFunction<FieldReadItemAccessArgs<BaseListTypeInfo>>,
+  listKey: string,
+  fieldKey: string,
+  lists: Record<string, InitialisedList>
+) {
+  const list = lists[listKey]
+
+  return g.field({
+    type: output.type,
+    deprecationReason: output.deprecationReason,
+    description: output.description,
+    args: output.args,
+    extensions: output.extensions,
+    async resolve(item: BaseItem, args, context, info) {
+      const id = item.id as IdType
+      const fieldAccess = await getOperationFieldAccess(item, list, fieldKey, context, 'read')
+      if (!fieldAccess) return null
+
+      // only static cache hints are supported at the field level until a use-case makes it clear what parameters a dynamic hint would take
+      if (cacheHint && info) {
+        maybeCacheControlFromInfo(info)?.setCacheHint(cacheHint)
+      }
+
+      const value = getValueForDBField(item, dbField, id, fieldKey, context, lists, info)
+      if (output.resolve) {
+        return output.resolve({ value, item: item }, args, context, info)
+      } else {
+        return value
+      }
+    },
+  })
+}

package/src/lib/core/queries/resolvers.ts

@@ -0,0 +1,258 @@
+import { maybeCacheControlFromInfo } from '@apollo/cache-control-types'
+import { type GraphQLResolveInfo } from 'graphql'
+import type { BaseItem, FindManyArgsValue, NixxieContext, OrderDirection } from '../../../types'
+import { type PrismaFilter, type UniquePrismaFilter } from '../../../types/prisma'
+
+import { getOperationAccess, getAccessFilters } from '../access-control'
+import {
+  type UniqueInputFilter,
+  type InputFilter,
+  resolveUniqueWhereInput,
+  resolveWhereInput,
+} from '../where-inputs'
+
+import { limitsExceededError, userInputError } from '../graphql-errors'
+import type { InitialisedList } from '../initialise-lists'
+import { getDBFieldKeyForFieldOnMultiField } from '../utils'
+import { checkFilterOrderAccess } from '../filter-order-access'
+
+// we want to put the value we get back from the field's unique where resolver into an equals
+// rather than directly passing the value as the filter (even though Prisma supports that), we use equals
+// because we want to disallow fields from providing an arbitrary filter
+export function mapUniqueWhereToWhere(uniqueWhere: UniquePrismaFilter, list: InitialisedList) {
+  const where: PrismaFilter = {}
+  for (const key in uniqueWhere) {
+    if (list.fields[key].dbField.kind === 'relation') {
+      const foreignList = list.lists[list.fields[key].dbField.list]
+      where[key] = mapUniqueWhereToWhere(uniqueWhere[key], foreignList)
+      continue
+    }
+    where[key] = { equals: uniqueWhere[key] }
+  }
+  return where
+}
+
+export function* traverse(
+  list: InitialisedList,
+  inputFilter: InputFilter | UniqueInputFilter
+): Generator<{ fieldKey: string; list: InitialisedList }, void, unknown> {
+  for (const fieldKey in inputFilter) {
+    const value = inputFilter[fieldKey]
+    if (fieldKey === 'OR' || fieldKey === 'AND' || fieldKey === 'NOT') {
+      for (const condition of value) {
+        yield* traverse(list, condition)
+      }
+    } else if (fieldKey === 'some' || fieldKey === 'none' || fieldKey === 'every') {
+      yield* traverse(list, value)
+    } else {
+      yield { fieldKey, list }
+
+      // if it's a relationship, check the nested filters.
+      const field = list.fields[fieldKey]
+      if (field.dbField.kind === 'relation' && value !== null) {
+        const foreignList = list.lists[field.dbField.list]
+
+        yield* traverse(foreignList, value)
+      }
+    }
+  }
+}
+
+export async function accessControlledFilter(
+  list: InitialisedList,
+  context: NixxieContext,
+  resolvedWhere: PrismaFilter,
+  accessFilters: boolean | InputFilter
+) {
+  // Merge the filter access control
+  if (typeof accessFilters === 'object') {
+    resolvedWhere = { AND: [resolvedWhere, await resolveWhereInput(accessFilters, list, context)] }
+  }
+
+  return resolvedWhere
+}
+
+export async function findOne(
+  args: { where: UniqueInputFilter },
+  list: InitialisedList,
+  context: NixxieContext,
+  info: GraphQLResolveInfo
+) {
+  // check operation permission to pass into single operation
+  const operationAccess = await getOperationAccess(list, context, 'query')
+  if (!operationAccess) return null
+
+  const accessFilters = await getAccessFilters(list, context, 'query')
+  if (accessFilters === false) return null
+
+  // validate and resolve the input filter
+  const uniqueWhere = await resolveUniqueWhereInput(args.where, list, context)
+  const resolvedWhere = mapUniqueWhereToWhere(uniqueWhere, list)
+
+  // findOne requires at least one filter
+  if (Object.keys(resolvedWhere).length === 0) return null
+
+  // check filter access
+  await checkFilterOrderAccess([...traverse(list, args.where)], context, 'filter')
+
+  // apply access control
+  const filter = await accessControlledFilter(list, context, resolvedWhere, accessFilters)
+  const result = await context.prisma[list.listKey].findFirst({ where: filter })
+
+  if (list.cacheHint) {
+    maybeCacheControlFromInfo(info)?.setCacheHint(
+      list.cacheHint({
+        results: result ? [result] : [],
+        operationName: info.operation.name?.value,
+        meta: false,
+      })
+    )
+  }
+
+  return result
+}
+
+export async function findMany(
+  { where, take, skip, orderBy: rawOrderBy, cursor }: FindManyArgsValue,
+  list: InitialisedList,
+  context: NixxieContext,
+  info: GraphQLResolveInfo,
+  extraFilter?: PrismaFilter
+): Promise<BaseItem[]> {
+  const maxTake = (list.graphql.types.findManyArgs.take.defaultValue ?? Infinity) as number
+  if ((take ?? Infinity) > maxTake) {
+    throw limitsExceededError({ list: list.listKey, type: 'maxTake', limit: maxTake })
+  }
+
+  // check operation permission to pass into single operation
+  const operationAccess = await getOperationAccess(list, context, 'query')
+  if (!operationAccess) return []
+
+  const accessFilters = await getAccessFilters(list, context, 'query')
+  if (accessFilters === false) return []
+
+  // validate and resolve the input filter
+  const resolvedWhere = await resolveWhereInput(where, list, context)
+
+  // check filter access (TODO: why isn't this using resolvedWhere)
+  await checkFilterOrderAccess([...traverse(list, where)], context, 'filter')
+
+  // check filter access for cursor
+  if (cursor) {
+    await checkFilterOrderAccess([...traverse(list, cursor)], context, 'filter')
+  }
+
+  // WARNING: this checks .isOrderable
+  const orderBy = await resolveOrderBy(rawOrderBy, list, context)
+
+  // apply access control
+  const filter = await accessControlledFilter(list, context, resolvedWhere, accessFilters)
+  const results = await context.prisma[list.listKey].findMany({
+    where: extraFilter === undefined ? filter : { AND: [filter, extraFilter] },
+    orderBy,
+    take: take ?? undefined,
+    skip,
+    cursor: cursor ?? undefined,
+  })
+
+  if (list.cacheHint) {
+    maybeCacheControlFromInfo(info)?.setCacheHint(
+      list.cacheHint({
+        results,
+        operationName: info.operation.name?.value,
+        meta: false,
+      })
+    )
+  }
+  return results
+}
+
+async function resolveOrderBy(
+  orderBy: readonly Record<string, any>[],
+  list: InitialisedList,
+  context: NixxieContext
+): Promise<readonly Record<string, OrderDirection>[]> {
+  // Check input format. FIXME: Group all errors
+  orderBy.forEach(orderBySelection => {
+    const keys = Object.keys(orderBySelection)
+    if (keys.length !== 1) {
+      throw userInputError(`Only a single key must be passed to ${list.graphql.types.orderBy.name}`)
+    }
+
+    const fieldKey = keys[0]
+    const value = orderBySelection[fieldKey]
+    if (value === null) {
+      throw userInputError('null cannot be passed as an order direction')
+    }
+  })
+
+  // Check orderBy access
+  const orderByKeys = orderBy.map(orderBySelection => ({
+    fieldKey: Object.keys(orderBySelection)[0],
+    list,
+  }))
+  await checkFilterOrderAccess(orderByKeys, context, 'orderBy')
+
+  return await Promise.all(
+    orderBy.map(async orderBySelection => {
+      const keys = Object.keys(orderBySelection)
+      const fieldKey = keys[0]
+      const value = orderBySelection[fieldKey]
+      const field = list.fields[fieldKey]
+      const resolve = field.input!.orderBy!.resolve
+      const resolvedValue = resolve ? await resolve(value, context) : value
+      if (field.dbField.kind === 'multi') {
+        // Note: no built-in field types support multi valued database fields *and* orderBy.
+        // This code path is only relevent to custom fields which fit that criteria.
+        const keys = Object.keys(resolvedValue)
+        if (keys.length !== 1) {
+          throw new Error(
+            `Only a single key must be returned from an orderBy input resolver for a multi db field`
+          )
+        }
+        const innerKey = keys[0]
+        return {
+          [getDBFieldKeyForFieldOnMultiField(fieldKey, innerKey)]: resolvedValue[innerKey],
+        }
+      } else {
+        return { [fieldKey]: resolvedValue }
+      }
+    })
+  )
+}
+
+export async function count(
+  { where }: { where: Record<string, unknown> },
+  list: InitialisedList,
+  context: NixxieContext,
+  info: GraphQLResolveInfo,
+  extraFilter?: PrismaFilter
+) {
+  const operationAccess = await getOperationAccess(list, context, 'query')
+  if (!operationAccess) return 0
+
+  const accessFilters = await getAccessFilters(list, context, 'query')
+  if (accessFilters === false) return 0
+
+  const resolvedWhere = await resolveWhereInput(where, list, context)
+
+  // check filter access (TODO: why isn't this using resolvedWhere)
+  await checkFilterOrderAccess([...traverse(list, where)], context, 'filter')
+
+  const filter = await accessControlledFilter(list, context, resolvedWhere, accessFilters)
+
+  const count = await context.prisma[list.listKey].count({
+    where: extraFilter === undefined ? filter : { AND: [filter, extraFilter] },
+  })
+
+  if (list.cacheHint) {
+    maybeCacheControlFromInfo(info)?.setCacheHint(
+      list.cacheHint({
+        results: count,
+        operationName: info.operation.name?.value,
+        meta: true,
+      })
+    )
+  }
+  return count
+}