@opensaas/stack-core 0.39.2 → 0.41.0

package/tests/context.test.ts

@@ -48,6 +48,7 @@ describe('getContext', () => {
           fields: {
             name: { type: 'text' },
             email: { type: 'text', isIndexed: 'unique' },
+            posts: { type: 'relationship', ref: 'Post.author', many: true },
           },
           access: {
             operation: {
@@ -895,6 +896,224 @@ describe('getContext', () => {
         const created = result as { created: boolean; fieldErrors?: Record<string, string> }
         expect(created.fieldErrors?.title).toBeDefined()
       })
+
+      // Prisma 7 driver adapters (verified against @prisma/adapter-pg and PGlite,
+      // issue #979) leave `meta.target` undefined and put the equivalent data at
+      // `meta.driverAdapterError.cause` instead, as free-text-adjacent structured
+      // data rather than the documented shape.
+      describe('P2002 under Prisma 7 driver adapters (issue #979)', () => {
+        it('produces per-field errors for a composite unique violation', async () => {
+          mockPrisma.post.create.mockRejectedValue({
+            code: 'P2002',
+            meta: {
+              modelName: 'Post',
+              driverAdapterError: {
+                name: 'DriverAdapterError',
+                cause: {
+                  originalCode: '23505',
+                  originalMessage:
+                    'duplicate key value violates unique constraint "post_title_content_key"',
+                  kind: 'UniqueConstraintViolation',
+                  constraint: { fields: ['title', 'content'] },
+                },
+              },
+            },
+          })
+          mockPrisma.user.findUnique.mockResolvedValue({ id: 'u1' })
+
+          const context = await getContext(config, mockPrisma, { userId: 'u1' })
+          const result = await context.serverAction({
+            listKey: 'Post',
+            action: 'createRelated',
+            data: { title: 'Dup', content: 'Dup' },
+            field: 'author',
+            parentId: 'u1',
+          })
+
+          expect(result).toMatchObject({ created: false })
+          const created = result as { created: boolean; fieldErrors?: Record<string, string> }
+          expect(created.fieldErrors?.title).toBeDefined()
+          expect(created.fieldErrors?.content).toBeDefined()
+        })
+
+        it('produces a field error for a single-column unique violation', async () => {
+          mockPrisma.post.create.mockRejectedValue({
+            code: 'P2002',
+            meta: {
+              modelName: 'Post',
+              driverAdapterError: {
+                cause: {
+                  originalMessage:
+                    'duplicate key value violates unique constraint "post_title_key"',
+                  constraint: { fields: ['title'] },
+                },
+              },
+            },
+          })
+          mockPrisma.user.findUnique.mockResolvedValue({ id: 'u1' })
+
+          const context = await getContext(config, mockPrisma, { userId: 'u1' })
+          const result = await context.serverAction({
+            listKey: 'Post',
+            action: 'createRelated',
+            data: { title: 'Dup' },
+            field: 'author',
+            parentId: 'u1',
+          })
+
+          const created = result as { created: boolean; fieldErrors?: Record<string, string> }
+          expect(created.fieldErrors?.title).toBeDefined()
+        })
+
+        it('strips quotes so a camelCase column is keyed correctly (not left quoted)', async () => {
+          // Postgres quotes an identifier in `constraint.fields` only when it
+          // needed quoting — a camelCase column arrives as `"authorId"`. A naive
+          // fix that skips stripping would key fieldErrors by the literal string
+          // `"authorId"` (quotes included), missing the real field name.
+          mockPrisma.post.create.mockRejectedValue({
+            code: 'P2002',
+            meta: {
+              driverAdapterError: {
+                cause: {
+                  originalMessage:
+                    'duplicate key value violates unique constraint "post_authorId_key"',
+                  constraint: { fields: ['"authorId"'] },
+                },
+              },
+            },
+          })
+          mockPrisma.user.findUnique.mockResolvedValue({ id: 'u1' })
+
+          const context = await getContext(config, mockPrisma, { userId: 'u1' })
+          const result = await context.serverAction({
+            listKey: 'Post',
+            action: 'createRelated',
+            data: { title: 'Dup' },
+            field: 'author',
+            parentId: 'u1',
+          })
+
+          const created = result as { created: boolean; fieldErrors?: Record<string, string> }
+          expect(created.fieldErrors).toEqual({ authorId: 'This value is already in use' })
+        })
+
+        it('humanizes a camelCase field name in the message instead of running words together', async () => {
+          // Before this fix, `target` was always empty under a driver adapter, so
+          // this label-formatting path never ran for a camelCase column. Recovering
+          // real column names makes it reachable — verify it reads as words, not
+          // "tenantid".
+          const camelCaseConfig: OpenSaasConfig = {
+            ...config,
+            lists: {
+              ...config.lists,
+              Post: {
+                ...config.lists.Post,
+                fields: { ...config.lists.Post.fields, tenantSlug: { type: 'text' } },
+              },
+            },
+          }
+          mockPrisma.post.create.mockRejectedValue({
+            code: 'P2002',
+            meta: {
+              driverAdapterError: {
+                cause: {
+                  originalMessage:
+                    'duplicate key value violates unique constraint "post_tenantSlug_key"',
+                  constraint: { fields: ['"tenantSlug"'] },
+                },
+              },
+            },
+          })
+          mockPrisma.user.findUnique.mockResolvedValue({ id: 'u1' })
+
+          const context = await getContext(camelCaseConfig, mockPrisma, { userId: 'u1' })
+          const result = await context.serverAction({
+            listKey: 'Post',
+            action: 'createRelated',
+            data: { title: 'Dup' },
+            field: 'author',
+            parentId: 'u1',
+          })
+
+          const created = result as { created: boolean; fieldErrors?: Record<string, string> }
+          expect(created.fieldErrors).toEqual({
+            tenantSlug: 'This tenant slug is already in use',
+          })
+        })
+
+        it('leaves an already-populated meta.target unaffected (existing path still wins)', async () => {
+          mockPrisma.post.create.mockRejectedValue({
+            code: 'P2002',
+            meta: {
+              target: ['title'],
+              // Present but must be ignored — meta.target already answers the question.
+              driverAdapterError: {
+                cause: {
+                  originalMessage: 'duplicate key value violates unique constraint "other_key"',
+                  constraint: { fields: ['content'] },
+                },
+              },
+            },
+          })
+          mockPrisma.user.findUnique.mockResolvedValue({ id: 'u1' })
+
+          const context = await getContext(config, mockPrisma, { userId: 'u1' })
+          const result = await context.serverAction({
+            listKey: 'Post',
+            action: 'createRelated',
+            data: { title: 'Dup' },
+            field: 'author',
+            parentId: 'u1',
+          })
+
+          const created = result as { created: boolean; fieldErrors?: Record<string, string> }
+          expect(created.fieldErrors).toEqual({ title: 'This title is already in use' })
+        })
+
+        it('falls back to the generic message (not a throw) when nothing is recoverable', async () => {
+          mockPrisma.post.create.mockRejectedValue({ code: 'P2002', meta: {} })
+          mockPrisma.user.findUnique.mockResolvedValue({ id: 'u1' })
+
+          const context = await getContext(config, mockPrisma, { userId: 'u1' })
+          const result = await context.serverAction({
+            listKey: 'Post',
+            action: 'createRelated',
+            data: { title: 'Dup' },
+            field: 'author',
+            parentId: 'u1',
+          })
+
+          expect(result).toEqual({
+            created: false,
+            error: 'A record with this value already exists',
+            fieldErrors: {},
+          })
+        })
+
+        it('leaves a non-P2002 Prisma error unaffected', async () => {
+          mockPrisma.post.create.mockRejectedValue({
+            code: 'P2025',
+            meta: { driverAdapterError: { cause: { constraint: { fields: ['title'] } } } },
+            message: 'Record to update not found',
+          })
+          mockPrisma.user.findUnique.mockResolvedValue({ id: 'u1' })
+
+          const context = await getContext(config, mockPrisma, { userId: 'u1' })
+          const result = await context.serverAction({
+            listKey: 'Post',
+            action: 'createRelated',
+            data: { title: 'Dup' },
+            field: 'author',
+            parentId: 'u1',
+          })
+
+          expect(result).toEqual({
+            created: false,
+            error: 'Record to update not found',
+            fieldErrors: {},
+          })
+        })
+      })
     })
 
     describe('relationshipOptions', () => {
@@ -2063,6 +2282,59 @@ describe('getContext', () => {
         expect(call.include.posts.where).toEqual({ status: { equals: 'published' } })
       })
 
+      it('caller `_count` folds the relation access where into the select (#1087)', async () => {
+        relPrisma.author.findMany.mockResolvedValue([
+          { id: 'a1', name: 'Jo', _count: { posts: 3 } },
+        ])
+
+        const context = await getContext(relConfig, relPrisma, null)
+        const result = await context.db.author.findMany({
+          include: { _count: { select: { posts: true } } },
+        })
+
+        const call = relPrisma.author.findMany.mock.calls[0][0]
+        expect(call.include._count).toEqual({
+          select: { posts: { where: { status: { equals: 'published' } } } },
+        })
+        expect(result[0]._count).toEqual({ posts: 3 })
+      })
+
+      it('caller `_count` on a fully-denied relation is omitted from the select and returns 0 (#1087)', async () => {
+        relPrisma.author.findMany.mockResolvedValue([{ id: 'a1', name: 'Jo' }])
+
+        const context = await getContext(relConfig, relPrisma, null)
+        const result = await context.db.author.findMany({
+          include: { _count: { select: { posts: true, secrets: true } } },
+        })
+
+        const call = relPrisma.author.findMany.mock.calls[0][0]
+        // The denied `Secret` list is never asked to be counted...
+        expect(call.include._count).toEqual({
+          select: { posts: { where: { status: { equals: 'published' } } } },
+        })
+        // ...but the caller still sees an explicit `0`, never an absent key —
+        // a count is session-relative, and `0` is what "no visible rows" means.
+        expect(result[0]._count).toEqual({ secrets: 0 })
+      })
+
+      it('sudo `_count` is used as-is, unscoped (behaviour preserved)', async () => {
+        relPrisma.author.findMany.mockResolvedValue([
+          { id: 'a1', name: 'Jo', _count: { posts: 3, secrets: 7 } },
+        ])
+
+        const context = await getContext(relConfig, relPrisma, null).sudo()
+        const result = await context.db.author.findMany({
+          include: { _count: { select: { posts: true, secrets: true } } },
+        })
+
+        expect(relPrisma.author.findMany).toHaveBeenCalledWith(
+          expect.objectContaining({
+            include: { _count: { select: { posts: true, secrets: true } } },
+          }),
+        )
+        expect(result[0]._count).toEqual({ posts: 3, secrets: 7 })
+      })
+
       it('AND-combines a caller nested where with the relation access where', async () => {
         relPrisma.author.findMany.mockResolvedValue([{ id: 'a1', name: 'Jo', posts: [] }])
 
@@ -2104,7 +2376,7 @@ describe('getContext', () => {
         )
       })
 
-      it('query fragment path is unaffected by the merge (fragment include used, unfiltered)', async () => {
+      it('query fragment path carries the access filter, same as the include: path (#1088)', async () => {
         relPrisma.author.findMany.mockResolvedValue([{ id: 'a1', name: 'Jo', posts: [] }])
 
         const postsFragment = defineFragment<{ id: string; title: string }>()({
@@ -2120,10 +2392,144 @@ describe('getContext', () => {
         await context.db.author.findMany({ query: fragment })
 
         const call = relPrisma.author.findMany.mock.calls[0][0]
-        // Fragment-built include is used as-is; the merge helper is NOT applied to
-        // the fragment path, so the relation carries no access `where` here. (The
-        // fragment posts-selection contains only scalars, so it builds to `true`.)
-        expect(call.include).toEqual({ posts: true })
+        // The fragment-built include now runs through the same scoping walk as
+        // an explicit caller `include`, so `posts` carries Post's access where
+        // (matching the `include: { posts: true }` test above) instead of a
+        // bare, unfiltered `true`.
+        expect(call.include).toEqual({ posts: { where: { status: { equals: 'published' } } } })
+      })
+
+      it('drops a relation whose query access is false when named in a query fragment', async () => {
+        relPrisma.author.findMany.mockResolvedValue([{ id: 'a1', name: 'Jo' }])
+
+        const secretsFragment = defineFragment<{ id: string; value: string }>()({
+          value: true,
+        } as const)
+        const fragment = defineFragment<{ id: string; name: string; secrets: unknown }>()({
+          id: true,
+          name: true,
+          secrets: secretsFragment,
+        } as const)
+
+        const context = await getContext(relConfig, relPrisma, null)
+        await context.db.author.findMany({ query: fragment })
+
+        const call = relPrisma.author.findMany.mock.calls[0][0]
+        // `Secret`'s query access is `() => false` — the denied relation is
+        // dropped from the include entirely, same as the `include:` path.
+        expect(call.include.secrets).toBeUndefined()
+      })
+
+      it('a fragment nesting past the depth cap raises the same depth error a caller include does', async () => {
+        const chainLength = READ_INCLUDE_MAX_DEPTH + 2
+        const chainConfig: OpenSaasConfig = {
+          db: { provider: 'postgresql', url: 'postgresql://localhost:5432/test' },
+          lists: {},
+        }
+        for (let i = 0; i < chainLength; i++) {
+          // eslint-disable-next-line @typescript-eslint/no-explicit-any -- minimal config for unit test
+          const fields: Record<string, any> = { name: { type: 'text' } }
+          if (i < chainLength - 1) fields.next = { type: 'relationship', ref: `D${i + 1}.prev` }
+          if (i > 0) fields.prev = { type: 'relationship', ref: `D${i - 1}.next` }
+          chainConfig.lists[`D${i}`] = { fields, access: { operation: { query: () => true } } }
+        }
+        // eslint-disable-next-line @typescript-eslint/no-explicit-any
+        const chainPrisma: any = {}
+        for (let i = 0; i < chainLength; i++) {
+          chainPrisma[`d${i}`] = { findMany: vi.fn(), findFirst: vi.fn(), findUnique: vi.fn() }
+        }
+
+        // A fragment selecting `next` recursively, `hops` levels deep.
+        function nestedFragmentFields(hops: number): Record<string, unknown> {
+          if (hops <= 0) return { name: true }
+          return {
+            name: true,
+            next: defineFragment<Record<string, unknown>>()(nestedFragmentFields(hops - 1)),
+          }
+        }
+        const deepFragment = defineFragment<Record<string, unknown>>()(
+          nestedFragmentFields(READ_INCLUDE_MAX_DEPTH + 1),
+        )
+
+        const context = await getContext(chainConfig, chainPrisma, null)
+
+        await expect(context.db.d0.findMany({ query: deepFragment })).rejects.toThrow(
+          AccessScopeDepthExceededError,
+        )
+        expect(chainPrisma.d0.findMany).not.toHaveBeenCalled()
+      })
+
+      it('sudo query fragment reads stay unscoped (behaviour preserved)', async () => {
+        relPrisma.author.findMany.mockResolvedValue([{ id: 'a1', name: 'Jo' }])
+
+        const secretsFragment = defineFragment<{ id: string; value: string }>()({
+          value: true,
+        } as const)
+        const fragment = defineFragment<{ id: string; name: string; secrets: unknown }>()({
+          id: true,
+          name: true,
+          secrets: secretsFragment,
+        } as const)
+
+        const context = await getContext(relConfig, relPrisma, null).sudo()
+        await context.db.author.findMany({ query: fragment })
+
+        // Under sudo, the fragment-built include is used as-is: the denied
+        // `Secret` relation is fetched unfiltered, matching sudo's existing
+        // include: behaviour.
+        expect(relPrisma.author.findMany).toHaveBeenCalledWith(
+          expect.objectContaining({ include: { secrets: true } }),
+        )
+      })
+
+      it('a fragment read on a to-one relation nulls out a row its related list denies, matching include: (#974)', async () => {
+        // `Comment.post` is a to-one relation onto `Post`, whose query access
+        // is a row filter (`status: published`) rather than a plain boolean —
+        // Prisma can't carry that as a `where` on a to-one include, so it's
+        // resolved via the post-query existence check instead.
+        const postFragment = defineFragment<{ id: string; title: string }>()({
+          title: true,
+        } as const)
+        const fragment = defineFragment<{ id: string; body: string; post: unknown }>()({
+          id: true,
+          body: true,
+          post: postFragment,
+        } as const)
+
+        relPrisma.comment.findMany.mockResolvedValue([
+          { id: 'c1', body: 'hi', post: { id: 'p1', title: 'Draft' } },
+        ])
+        // The batched existence check queries the raw Post model directly;
+        // an empty result means `p1` does not satisfy Post's access filter.
+        relPrisma.post.findMany.mockResolvedValue([])
+
+        const context = await getContext(relConfig, relPrisma, null)
+        const result = await context.db.comment.findMany({ query: fragment })
+
+        expect(result[0].post).toBeNull()
+      })
+
+      it('a fragment read and an equivalent include: read produce the same access-scoped include', async () => {
+        relPrisma.author.findMany.mockResolvedValue([{ id: 'a1', name: 'Jo', posts: [] }])
+
+        const postsFragment = defineFragment<{ id: string; title: string }>()({
+          title: true,
+        } as const)
+        const fragment = defineFragment<{ id: string; name: string; posts: unknown }>()({
+          id: true,
+          name: true,
+          posts: postsFragment,
+        } as const)
+
+        const context = await getContext(relConfig, relPrisma, null)
+        await context.db.author.findMany({ query: fragment })
+        const fragmentInclude = relPrisma.author.findMany.mock.calls[0][0].include
+
+        relPrisma.author.findMany.mockClear()
+        await context.db.author.findMany({ include: { posts: true } })
+        const callerInclude = relPrisma.author.findMany.mock.calls[0][0].include
+
+        expect(fragmentInclude).toEqual(callerInclude)
       })
 
       // Core new guarantee introduced by #852 / ADR-0026: naming one relation
@@ -2194,7 +2600,7 @@ describe('getContext', () => {
           }
         }
 
-        it('findUnique inside a resolveOutput hook row-scopes the relation instead of dropping the where', async () => {
+        it('findUnique inside a resolveOutput hook still fetches the relation, unscoped at the Prisma level (#974)', async () => {
           let innerIncludeSeen: unknown
           const hookConfig = configWithResolveOutputProbe({ post: true }, (include) => {
             innerIncludeSeen = include
@@ -2206,9 +2612,11 @@ describe('getContext', () => {
           const context = await getContext(hookConfig, relPrisma, null)
           await context.db.author.findUnique({ where: { id: 'a1' } })
 
-          // `post` is still fetched (not dropped) but now carries Post's own
-          // query-access `where` — it is no longer a bare, unscoped `true`.
-          expect(innerIncludeSeen).toEqual({ post: { where: { status: { equals: 'published' } } } })
+          // `post` is still fetched (not dropped). It carries no `where` — Post
+          // is a to-one relation here, and Prisma rejects a `where` on a to-one
+          // include (#974); Post's own access filter is enforced afterward via
+          // a batched existence check instead (see access-filter.test.ts).
+          expect(innerIncludeSeen).toEqual({ post: true })
         })
 
         it('findMany inside a resolveOutput hook scopes the relation but does not auto-expand its nested include', async () => {
@@ -2227,10 +2635,10 @@ describe('getContext', () => {
           await context.db.author.findMany()
 
           // The caller's own nested selection (`post.include.author`) is honoured
-          // as-is (access control does not auto-descend further here), while
-          // `post` itself picks up its access `where`.
+          // as-is (access control does not auto-descend further here). `post`
+          // itself carries no `where` — see the findUnique test above (#974).
           expect(innerIncludeSeen).toEqual({
-            post: { where: { status: { equals: 'published' } }, include: { author: true } },
+            post: { include: { author: true } },
           })
         })
       })
@@ -2289,7 +2697,7 @@ describe('getContext', () => {
           expect(chainPrisma.c0.findMany).not.toHaveBeenCalled()
         })
 
-        it('still returns correctly row-scoped data for the same include one hop shallower', async () => {
+        it('still applies row-scoping at the deepest hop for the same include one hop shallower', async () => {
           const chainLength = READ_INCLUDE_MAX_DEPTH + 1
           const chainConfig: OpenSaasConfig = {
             db: { provider: 'postgresql', url: 'postgresql://localhost:5432/test' },
@@ -2300,7 +2708,20 @@ describe('getContext', () => {
           for (let i = 0; i < chainLength; i++) {
             chainPrisma[`c${i}`] = { findMany: vi.fn(), findFirst: vi.fn(), findUnique: vi.fn() }
           }
-          chainPrisma.c0.findMany.mockResolvedValue([])
+
+          // Every hop here is to-one (no `many: true`), so none of them can
+          // carry a `where` on the Prisma include (#974) — the chain comes
+          // back unscoped at the Prisma level, one nested object per hop, and
+          // row-scoping is enforced afterward via a batched existence check
+          // per hop instead.
+          let deepestItem: Record<string, unknown> = { id: `id${chainLength - 1}`, name: 'leaf' }
+          for (let i = chainLength - 2; i >= 0; i--) {
+            deepestItem = { id: `id${i}`, name: 'x', next: deepestItem }
+          }
+          chainPrisma.c0.findMany.mockResolvedValue([deepestItem])
+          for (let i = 1; i < chainLength; i++) {
+            chainPrisma[`c${i}`].findMany.mockResolvedValue([{ id: `id${i}` }])
+          }
 
           const context = await getContext(chainConfig, chainPrisma, null)
 
@@ -2308,13 +2729,27 @@ describe('getContext', () => {
             include: { next: nestedCallerInclude(READ_INCLUDE_MAX_DEPTH - 1) },
           })
 
-          // Walk the built include down to the last list — it must carry that
-          // list's own access `where`, proving row scoping, not just "no throw".
+          // Walk the built include down to the last list — no hop carries a
+          // `where` (they are all to-one).
           let entry = chainPrisma.c0.findMany.mock.calls[0][0].include.next
           for (let i = 1; i < READ_INCLUDE_MAX_DEPTH; i++) {
+            expect(entry.where).toBeUndefined()
             entry = entry.include.next
           }
-          expect(entry.where).toEqual({ ownerId: { equals: `C${READ_INCLUDE_MAX_DEPTH}` } })
+          expect(entry.where).toBeUndefined()
+
+          // The deepest hop's own existence check still carries that list's
+          // access filter — row scoping reaches all the way down, just not
+          // through the Prisma `include` itself.
+          expect(chainPrisma[`c${READ_INCLUDE_MAX_DEPTH}`].findMany).toHaveBeenCalledWith({
+            where: {
+              AND: [
+                { ownerId: { equals: `C${READ_INCLUDE_MAX_DEPTH}` } },
+                { id: { in: [`id${READ_INCLUDE_MAX_DEPTH}`] } },
+              ],
+            },
+            select: { id: true },
+          })
         })
       })