@rowstile/prisma 0.1.0-alpha.3 → 0.1.0-alpha.5

package/README.md

@@ -57,7 +57,9 @@ Traps it handles:
   transactions, from the first caller's context. `authz()` runs each `findUnique` in a transaction of its own,
   and refuses `$transaction([...])` (use `$transaction(async (tx) => ...)`), so no query runs as someone else.
   Use the client `$extends(authz())` returns, and only that one: the client it was made from is refused
-  whenever it is used.
+  whenever it is used, inside your own extensions too. An extension you add to the client `authz()` returns is
+  placed before it, so `authz()` stays the last one: each of your query hooks runs once for a call, and sees
+  the errors `authz()` makes (`Refused`, `NotFound`).
 - **Inserts that read the row back** (`RETURNING`, Prisma's `create`) also need the select rule: Postgres's own
   message comes back as `Refused` naming the select rule.
 - **Prisma's promises are lazy**: `actingAs` and `job` await what they return inside their scope.

package/dist/index.js

@@ -8,16 +8,19 @@
  * in with authz.act_as() as whoever the code acts for (actingAs, a job), else user(), else nobody; a query
  * outside a transaction runs in one of its own. `authz()` turns the answers into errors: an update or delete
  * of a row the user can't see is NotFound (Prisma's P2025), of one they may not change Refused with the
- * reason, a refused create Refused naming the rule; and adds db.$authz (can, ids, permsOf, ...). It refuses
+ * reason, a refused create Refused naming the rule, a findUniqueOrThrow or findFirstOrThrow that finds no row
+ * NotFound; and adds db.$authz (can, ids, permsOf, ...). It refuses
  * array transactions, $transaction([...]): Prisma starts them from another caller's context.
  *
  * Use the client `$extends(authz())` returns, and only that one: the client it was made from is refused
  * whenever it is used (Prisma answers the findUnique calls of one tick with one query, signed in as whoever
- * called first).
+ * called first). That holds inside the app's own extensions too, on either side of authz(): an extension added
+ * to the client authz() returns is placed before it, so authz() stays the last one, and every hook of the
+ * app's runs once for each call, outside what authz() lets through.
  */
 import { AsyncLocalStorage } from "node:async_hooks";
 import { Prisma } from "@prisma/client/extension";
-import { actAs, calls, idText, signingIn, translate, verdict, } from "@rowstile/client";
+import { actAs, calls, idText, NotFound, signingIn, translate, verdict, } from "@rowstile/client";
 const ARG_TEXT = { scalarType: "string", dbType: undefined, arity: "scalar" };
 // Unless the adapter says otherwise (usePhantomQuery), Prisma sends COMMIT and ROLLBACK itself, and the
 // adapter's commit() and rollback() only give the connection back: so these send them too
@@ -106,6 +109,17 @@ export function signedIn(factory, options = {}) {
         },
     });
 }
+async function transactionOf(tx) {
+    let found;
+    const make = tx._createPrismaPromise;
+    if (typeof make === "function")
+        await make(async (t) => { found = t; });
+    if (found?.kind !== "itx") {
+        throw new Error("@rowstile/prisma: this version of Prisma starts its transactions another way; " +
+            "report it at https://github.com/rowstile/rowstile/issues with the version of @prisma/client");
+    }
+    return found;
+}
 /** The client extension: refusals and hidden rows as errors, and db.$authz. */
 export function authz(options = {}) {
     return Prisma.defineExtension((client) => {
@@ -151,8 +165,10 @@ export function authz(options = {}) {
                 return Object.values(v);
             return undefined;
         };
+        // through the client this returns (set below), whose last hook lets the query through
+        let self = raw;
         const q = {
-            query: async (text, values = []) => ({ rows: await extended(() => raw.$queryRawUnsafe(text, ...values)) }),
+            query: async (text, values = []) => ({ rows: await self.$queryRawUnsafe(text, ...values) }),
         };
         const c = calls(q);
         const $authz = {
@@ -176,9 +192,10 @@ export function authz(options = {}) {
                     try {
                         if (!internal?.transaction && model && (operation === "findUnique" || operation === "findUniqueOrThrow")) {
                             // Prisma answers the findUnique calls of one tick together, from the first caller's context: run each
-                            // in an interactive transaction of its own, which begins (and signs in) in this caller's context
-                            const delegate = model.charAt(0).toLowerCase() + model.slice(1);
-                            return await extended(() => raw.$transaction(async (tx) => tx[delegate][operation](args)));
+                            // in an interactive transaction of its own, which begins (and signs in) in this caller's context.
+                            // What is left of the call (this hook is the last: Prisma's own work) runs in it; calling the model
+                            // again on the transaction would run every hook of the app's a second time
+                            return await extended(() => raw.$transaction(async (tx) => query(args, { ...internal, transaction: await transactionOf(tx) })));
                         }
                         return await extended(() => query(args));
                     }
@@ -195,6 +212,12 @@ export function authz(options = {}) {
                                 }
                             }
                         }
+                        // a read that must find a row and found none: the row isn't there, or this user can't see it (the
+                        // two answer alike). Left as Prisma's P2025 it is a 500, where an update or a delete is a 404
+                        if (model && isP2025(e) && (operation === "findUniqueOrThrow" || operation === "findFirstOrThrow")) {
+                            const key = keyOf(model, args.where);
+                            throw new NotFound(tableOf(model), key === undefined ? undefined : idText(key), { cause: e });
+                        }
                         throw translate(e, schemaOf) ?? e;
                     }
                 },
@@ -202,7 +225,7 @@ export function authz(options = {}) {
             client: { $authz },
         });
         // a second layer, so that $parent has the hooks above: transactions begin through this client too. It
-        // changes nothing in $transaction's type.
+        // changes nothing in $transaction's type, nor in $extends's.
         // The transaction begins inside the mark, but the app's callback runs outside it: the callback is the app's
         // code, and a client not extended with authz() is refused there as anywhere (its findUnique calls would be
         // answered together). Queries through tx go through the transaction, which needs no mark. What the callback
@@ -215,8 +238,19 @@ export function authz(options = {}) {
                     ? (tx) => through.exit(async () => await fn(tx)) : fn;
                 return extended(() => parent.$transaction(app, ...rest));
             },
+            // An extension added to this client goes before authz(), which is then applied again: Prisma calls query
+            // hooks in the order they were added, so a hook added after authz()'s would run inside what it lets
+            // through, and the client authz() was made from would not be refused there. (A function is called with
+            // this client, as Prisma does: what it adds comes back here.)
+            $extends(extension) {
+                if (typeof extension === "function")
+                    return extension(this);
+                return raw.$extends(extension).$extends(authz(options));
+            },
         };
-        return hooks.$extends({ name: "rowstile-transactions", client: transactions });
+        const out = hooks.$extends({ name: "rowstile-transactions", client: transactions });
+        self = out;
+        return out;
     });
 }
 function isScalar(v) {

package/package.json

@@ -1,8 +1,10 @@
 {
   "name": "@rowstile/prisma",
-  "version": "0.1.0-alpha.3",
+  "version": "0.1.0-alpha.5",
   "description": "rowstile with Prisma: a client extension that signs every query in, and turns refusals into errors",
   "license": "Apache-2.0",
+  "homepage": "https://rowstile.dev",
+  "keywords": ["rowstile", "postgres", "postgresql", "authorization", "row-level-security", "rls", "permissions", "access-control", "rbac", "rebac", "multi-tenant", "prisma"],
   "repository": { "type": "git", "url": "git+https://github.com/rowstile/rowstile.git", "directory": "sdk/typescript/prisma" },
   "type": "module",
   "main": "./dist/index.js",
@@ -10,6 +12,6 @@
   "exports": { ".": { "types": "./dist/index.d.ts", "default": "./dist/index.js" } },
   "files": ["dist"],
   "sideEffects": false,
-  "dependencies": { "@rowstile/client": "0.1.0-alpha.3" },
+  "dependencies": { "@rowstile/client": "0.1.0-alpha.5" },
   "peerDependencies": { "@prisma/client": ">=7" }
 }