@simtlix/simfinity-js 3.5.9 → 3.6.0

package/README.md

@@ -20,7 +20,7 @@ const schema = simfinity.createSchema();
 
 Use a MongoDB replica set or sharded cluster for transactional mutations. The library requires Node.js >=18.18.0 and GraphQL 16.
 
-Generated single-reference reads can be batched within a request. Models with any `find` or `findOne` pre/post query hook retain individual `findOne` reads, including hooks shared by both operations, to preserve access restrictions and other middleware behavior. See the [relationship contract](https://simtlix.github.io/simfinity.js/guide/relationships.html).
+Generated single-reference reads can be batched within a request. Models with any `find` or `findOne` pre/post query hook retain individual `findOne` reads, including hooks shared by both operations, to preserve access restrictions and other middleware behavior. For the same reason, they keep the read that generated mutations otherwise skip before a delete without `onDelete` and before an update that merges no embedded value. So do models with `findOneAndUpdate` or `findOneAndDelete` hooks (including the one Mongoose's `timestamps` option adds) or with their own `findById`, `findOne`, `findByIdAndUpdate`, `findOneAndUpdate`, `findByIdAndDelete` or `findOneAndDelete` statics, which run before Mongoose casts the ID: the read rejects a malformed ID first. Models with application `_id` setters also keep the read, because setters can branch on the query operation before casting; Mongoose's built-in automatic ObjectId setter remains eligible for the optimization. See the [relationship contract](https://simtlix.github.io/simfinity.js/guide/relationships.html).
 
 Generated models store enum internal values with their own type (numbers, booleans or strings; other combinations as given) and support embedded fields named `type`. Embedded types that contain each other are rejected with `INVALID_MODEL` (`Embedded cycle at …`) when a generated model reaches them, and always in transactional mode; in the default mode, a cycle that only supplied models reach is not checked. Range filters, sorts and aggregates on numeric and boolean enums follow that type; PostgreSQL uses their text form. Earlier versions stored numeric and boolean enum values as strings; convert existing documents once as described in the [schema guide](https://simtlix.github.io/simfinity.js/guide/schema.html#what-gets-generated).
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@simtlix/simfinity-js",
-  "version": "3.5.9",
+  "version": "3.6.0",
   "description": "MongoDB/Mongoose adapter and compatibility facade for Simfinity GraphQL APIs",
   "main": "src/index.js",
   "types": "./types/index.d.ts",
@@ -29,8 +29,8 @@
     "owner": "simtlix"
   },
   "dependencies": {
-    "@simtlix/simfinity-core": "3.5.9",
-    "@simtlix/simfinity-mcp": "3.5.9"
+    "@simtlix/simfinity-core": "3.6.0",
+    "@simtlix/simfinity-mcp": "3.6.0"
   },
   "files": [
     "src",

package/src/mongo/adapter.js

@@ -39,16 +39,34 @@ const mapQueryIdCastErrors = (query, mapError = (error) => error) => {
 
 // Even a shared hook can branch on `this.op` or the filter shape. Preserve findOne semantics
 // whenever either query operation has hooks instead of inferring equivalence from function identity.
-const hasNoFindHooks = (hooks) => {
+const hasNoHooks = (hooks, operations) => {
   if (!(hooks?._pres instanceof Map) || !(hooks._posts instanceof Map)) return false;
-  return ['find', 'findOne'].every((operation) => !hooks._pres.get(operation)?.length
+  return operations.every((operation) => !hooks._pres.get(operation)?.length
     && !hooks._posts.get(operation)?.length);
 };
 
-// getById reads through `findOne` and getByIds through `find`. Mongoose copies the schema's query
-// hooks to the model when compiling it, so both registries must allow the batched read.
-const batchesFindOne = (Model) => hasNoFindHooks(Model.schema?.s?.hooks)
-  && (Model.Query?.prototype?._queryMiddleware == null || hasNoFindHooks(Model.Query.prototype._queryMiddleware));
+// Mongoose copies the schema's query hooks to the model when compiling it, so both registries must
+// be free of hooks for the operations.
+const hasNoQueryHooks = (Model, operations) => hasNoHooks(Model.schema?.s?.hooks, operations)
+  && (Model.Query?.prototype?._queryMiddleware == null || hasNoHooks(Model.Query.prototype._queryMiddleware, operations));
+
+// getById reads through `findOne` and getByIds through `find`.
+const batchesFindOne = (Model) => hasNoQueryHooks(Model, ['find', 'findOne']);
+
+// The statics that getById, update and delete call, directly or through each other.
+const BY_ID_STATICS = ['findById', 'findOne', 'findByIdAndUpdate', 'findOneAndUpdate', 'findByIdAndDelete', 'findOneAndDelete'];
+// Mongoose's automatic ObjectId setter only changes document assignments, never query filters.
+const autoIdSetter = new mongoose.Schema.Types.ObjectId('_id').auto(true).setters.at(-1);
+
+// update and delete write through findByIdAndUpdate and findByIdAndDelete, whose findOneAndUpdate and
+// findOneAndDelete middleware runs before Mongoose casts the ID. Such middleware, or an application
+// override of one of these statics (schema.static, loadClass), could guard the read or act on a
+// malformed ID that the read by ID rejects first, so the runtime keeps that read. ID setters also
+// run before casting and can branch on the query operation. A model from another Mongoose copy
+// has other statics and keeps the read too.
+const readsByIdAreInert = (Model) => BY_ID_STATICS.every((name) => Model[name] === mongoose.Model[name])
+  && Model.schema?.path('_id')?.setters?.every((setter) => setter === autoIdSetter)
+  && hasNoQueryHooks(Model, ['find', 'findOne', 'findOneAndUpdate', 'findOneAndDelete']);
 
 // `useDb()` connections share their parent's MongoClient, and a session belongs to a client.
 const clientOf = (connection) => connection.getClient?.() || connection;
@@ -272,6 +290,12 @@ export const createMongoAdapter = (options) => {
       // Trusted, so that the `sanitizeFilter` option does not wrap the operator in `$eq`.
       return Model.find({ _id: mongoose.trusted({ $in: ids }) });
     },
+    // Without middleware or overrides of the by-ID statics (see readsByIdAreInert), a read by ID has
+    // no side effects, and a malformed ID fails the update or delete before application code runs,
+    // as it fails the read.
+    readByIdIsInert(Model) {
+      return readsByIdAreInert(Model);
+    },
     prepareUpdate(set, unset) {
       return Object.keys(unset).length > 0 ? { ...set, $unset: unset } : set;
     },

package/src/mongo/integrity.js

@@ -4,7 +4,7 @@ import { withMongoTransaction } from './transactions.js';
 import { castModelId, mapIdCastError } from './ids.js';
 
 const LOCK_FIELD = '_simfinityReferenceLock';
-// Startup audit bounds: distinct target ids checked per query and ids remembered per target.
+// Distinct target ids per startup-audit query and per lock write, and ids the audit remembers per target.
 const AUDIT_BATCH_SIZE = 1000;
 const AUDIT_VERIFIED_LIMIT = 100000;
 const transactionOptions = { readConcern: { level: 'snapshot' }, writeConcern: { w: 'majority' } };
@@ -44,7 +44,10 @@ export const createMongoIntegrity = (options = {}) => {
   let ready = false;
   const models = new Map();
   const outgoing = new Map();
+  // Per target model: each referencing model once, with its paths to the target in declaration order.
   const incoming = new Map();
+  // Per model: _id and its reference paths, the fields modelReferences reads.
+  const projections = new Map();
 
   const assertRegistry = () => {
     const current = binding.getRegistrations();
@@ -100,6 +103,37 @@ export const createMongoIntegrity = (options = {}) => {
     return result.matchedCount > 0;
   };
 
+  // Lock the distinct targets of one record with one write per target collection (up to
+  // AUDIT_BATCH_SIZE ids each). A batch of several ids is read first in the transaction snapshot,
+  // so a missing target is a violation before the batch's write, whatever its position, and never
+  // a retried conflict with a concurrently locked target of the same batch. A single id keeps its
+  // single updateOne.
+  const lockTargets = async (references, session) => {
+    const byTarget = new Map();
+    for (const { target, id } of references) {
+      if (!byTarget.has(target)) byTarget.set(target, []);
+      byTarget.get(target).push(id);
+    }
+    for (const [target, ids] of byTarget) {
+      const Target = models.get(target);
+      for (let start = 0; start < ids.length; start += AUDIT_BATCH_SIZE) {
+        const batch = ids.slice(start, start + AUDIT_BATCH_SIZE);
+        if (batch.length === 1) {
+          if (!await lock(Target, batch[0], session)) throw violation();
+          continue;
+        }
+        const found = await Target.collection.find(
+          { _id: { $in: batch } }, { session, projection: { _id: 1 }, batchSize: batch.length + 1 },
+        ).toArray();
+        if (found.length !== batch.length) throw violation();
+        const result = await Target.collection.updateMany(
+          { _id: { $in: batch } }, { $set: { [LOCK_FIELD]: new mongoose.Types.ObjectId() } }, { session },
+        );
+        if (result.matchedCount !== batch.length) throw violation();
+      }
+    }
+  };
+
   const abortOnWriteError = async (session, body) => {
     try {
       return await body();
@@ -115,13 +149,12 @@ export const createMongoIntegrity = (options = {}) => {
   };
 
   const validateRecord = async (Model, record, session) => abortOnWriteError(session, async () => {
-    // Read the stored post-image, including setters/defaults and save middleware changes.
+    // Read the stored post-image, including setters/defaults and save middleware changes:
+    // only _id and the reference paths.
     if (!record?._id) throw violation();
-    const stored = await Model.collection.findOne({ _id: record._id }, { session });
+    const stored = await Model.collection.findOne({ _id: record._id }, { session, projection: projections.get(Model) });
     if (!stored) throw violation();
-    for (const { target, id } of modelReferences(Model, stored)) {
-      if (!await lock(models.get(target), id, session)) throw violation();
-    }
+    await lockTargets(modelReferences(Model, stored), session);
   });
 
   const initialize = async () => {
@@ -154,11 +187,16 @@ export const createMongoIntegrity = (options = {}) => {
     }
     if (!connection || connection.readyState !== 1) throw invalid('Connect MongoDB before initializing reference integrity');
     for (const [Model, paths] of outgoing) {
+      const projection = { _id: 1 };
       for (const reference of paths) {
+        const path = reference.path.join('.');
+        projection[path] = 1;
         const target = models.get(reference.target);
-        if (!incoming.has(target)) incoming.set(target, []);
-        incoming.get(target).push({ Model, path: reference.path.join('.') });
+        if (!incoming.has(target)) incoming.set(target, new Map());
+        if (!incoming.get(target).has(Model)) incoming.get(target).set(Model, []);
+        if (!incoming.get(target).get(Model).includes(path)) incoming.get(target).get(Model).push(path);
       }
+      projections.set(Model, projection);
     }
     for (const Model of models.values()) {
       if (createCollection) await Model.createCollection();
@@ -188,9 +226,7 @@ export const createMongoIntegrity = (options = {}) => {
     try {
       session.startTransaction({ readConcern: { level: 'snapshot' }, writeConcern: { w: 'majority' } });
       for (const Model of models.values()) {
-        const projection = { _id: 1, [LOCK_FIELD]: 1 };
-        for (const { path } of outgoing.get(Model)) projection[path.join('.')] = 1;
-        const cursor = Model.collection.find({}, { session, projection });
+        const cursor = Model.collection.find({}, { session, projection: { ...projections.get(Model), [LOCK_FIELD]: 1 } });
         try {
           for await (const record of cursor) {
             if (record[LOCK_FIELD] != null && record[LOCK_FIELD]?._bsontype !== 'ObjectId') {
@@ -278,11 +314,15 @@ export const createMongoIntegrity = (options = {}) => {
       return abortOnWriteError(session, async () => {
         const objectId = castModelId(Model, id);
         if (!await lock(Model, objectId, session)) return null;
-        for (const reference of incoming.get(Model) || []) {
-          const query = reference.Model === Model
-            ? { $and: [{ [reference.path]: objectId }, { _id: { $ne: objectId } }] }
-            : { [reference.path]: objectId };
-          if (await reference.Model.collection.findOne(query, { session, projection: { _id: 1 } })) throw violation();
+        // One query per referencing collection: the $or of its per-path queries, each branch served
+        // by its own path index. A self-reference ignores the deleted document itself. The $ne stays
+        // inside each branch: hoisted, the planner can pick a scan of the _id index instead.
+        for (const [Source, paths] of incoming.get(Model) || []) {
+          const matches = paths.map((path) => (Source === Model
+            ? { $and: [{ [path]: objectId }, { _id: { $ne: objectId } }] }
+            : { [path]: objectId }));
+          const query = matches.length === 1 ? matches[0] : { $or: matches };
+          if (await Source.collection.findOne(query, { session, projection: { _id: 1 } })) throw violation();
         }
         const deleted = await Model.findByIdAndDelete(objectId).session(session);
         if (!deleted?._id?.equals(objectId)