@rowstile/prisma 0.1.0-alpha.4 → 0.1.0-alpha.5

package/dist/index.js

@@ -8,7 +8,8 @@
  * in with authz.act_as() as whoever the code acts for (actingAs, a job), else user(), else nobody; a query
  * outside a transaction runs in one of its own. `authz()` turns the answers into errors: an update or delete
  * of a row the user can't see is NotFound (Prisma's P2025), of one they may not change Refused with the
- * reason, a refused create Refused naming the rule; and adds db.$authz (can, ids, permsOf, ...). It refuses
+ * reason, a refused create Refused naming the rule, a findUniqueOrThrow or findFirstOrThrow that finds no row
+ * NotFound; and adds db.$authz (can, ids, permsOf, ...). It refuses
  * array transactions, $transaction([...]): Prisma starts them from another caller's context.
  *
  * Use the client `$extends(authz())` returns, and only that one: the client it was made from is refused
@@ -19,7 +20,7 @@
  */
 import { AsyncLocalStorage } from "node:async_hooks";
 import { Prisma } from "@prisma/client/extension";
-import { actAs, calls, idText, signingIn, translate, verdict, } from "@rowstile/client";
+import { actAs, calls, idText, NotFound, signingIn, translate, verdict, } from "@rowstile/client";
 const ARG_TEXT = { scalarType: "string", dbType: undefined, arity: "scalar" };
 // Unless the adapter says otherwise (usePhantomQuery), Prisma sends COMMIT and ROLLBACK itself, and the
 // adapter's commit() and rollback() only give the connection back: so these send them too
@@ -211,6 +212,12 @@ export function authz(options = {}) {
                                 }
                             }
                         }
+                        // a read that must find a row and found none: the row isn't there, or this user can't see it (the
+                        // two answer alike). Left as Prisma's P2025 it is a 500, where an update or a delete is a 404
+                        if (model && isP2025(e) && (operation === "findUniqueOrThrow" || operation === "findFirstOrThrow")) {
+                            const key = keyOf(model, args.where);
+                            throw new NotFound(tableOf(model), key === undefined ? undefined : idText(key), { cause: e });
+                        }
                         throw translate(e, schemaOf) ?? e;
                     }
                 },

package/package.json

@@ -1,8 +1,10 @@
 {
   "name": "@rowstile/prisma",
-  "version": "0.1.0-alpha.4",
+  "version": "0.1.0-alpha.5",
   "description": "rowstile with Prisma: a client extension that signs every query in, and turns refusals into errors",
   "license": "Apache-2.0",
+  "homepage": "https://rowstile.dev",
+  "keywords": ["rowstile", "postgres", "postgresql", "authorization", "row-level-security", "rls", "permissions", "access-control", "rbac", "rebac", "multi-tenant", "prisma"],
   "repository": { "type": "git", "url": "git+https://github.com/rowstile/rowstile.git", "directory": "sdk/typescript/prisma" },
   "type": "module",
   "main": "./dist/index.js",
@@ -10,6 +12,6 @@
   "exports": { ".": { "types": "./dist/index.d.ts", "default": "./dist/index.js" } },
   "files": ["dist"],
   "sideEffects": false,
-  "dependencies": { "@rowstile/client": "0.1.0-alpha.4" },
+  "dependencies": { "@rowstile/client": "0.1.0-alpha.5" },
   "peerDependencies": { "@prisma/client": ">=7" }
 }