@ultimat3/entity 28.0.0 → 29.0.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ultimat3/entity",
-  "version": "28.0.0",
+  "version": "29.0.0",
   "description": "A table + its domain type + invariants the database also enforces",
   "license": "MIT",
   "type": "module",
@@ -26,16 +26,16 @@
     "LICENSE"
   ],
   "engines": {
-    "bun": ">=1.4.3"
+    "bun": ">=1.4.4"
   },
   "scripts": {
     "typecheck": "tsc --noEmit -p tsconfig.json",
     "test": "bun test"
   },
   "dependencies": {
-    "@ultimat3/core": "28.0.0",
-    "@ultimat3/db": "28.0.0",
-    "@ultimat3/schema": "28.0.0",
-    "@ultimat3/time": "28.0.0"
+    "@ultimat3/core": "29.0.0",
+    "@ultimat3/db": "29.0.0",
+    "@ultimat3/schema": "29.0.0",
+    "@ultimat3/time": "29.0.0"
   }
 }

package/src/memory-repo.ts

@@ -21,6 +21,7 @@ import { invariantViolated, notFound } from './errors';
 import { assertedRowsTooMany, hasJsOnlyInvariant, MAX_ASSERTED_ROWS } from './invariants';
 import { compareByKind, matchesPredicate } from './memory-match';
 import { uniqueClash, uniqueViolation } from './memory-unique';
+import { judgeUpdate, mergedRow } from './memory-update';
 import { deletePlan, idPlan, readPlan, singleKeyOf, updatePlan } from './plan';
 import type { FindManyArgs, MemoryRepo, RepoOptions, Transactor, Tx } from './repo';
 import { sealedFields } from './sealed';
@@ -74,14 +75,6 @@ const afterCursor = <Row>(
  * migration and tests use it everywhere. Postgres is the production driver and implements
  * this same interface.
  */
-/**
- * The patch with every `undefined` property dropped — `bindValues` skips them in Postgres, so a
- * patch built from optional input (`{ body: input.body }`) leaves the column alone in both drivers
- * rather than erasing it. `null` is the value that clears a column.
- */
-const defined = (patch: object): object =>
-  Object.fromEntries(Object.entries(patch).filter(([, value]) => value !== undefined));
-
 export const memoryRepo = <Row>(
   entity: EntityCore<Row>,
   seed: readonly Row[] = [],
@@ -182,6 +175,16 @@ export const memoryRepo = <Row>(
     return row;
   };
 
+  /**
+   * The stored rows a filtered write does NOT touch — the ones its results may not collide with.
+   * Every stored row counts, not only the visible ones: the unique index in Postgres covers the
+   * rows of another tenant and the soft-deleted ones too.
+   */
+  const untouched = (matched: readonly Row[]): Row[] => {
+    const keys = new Set(matched.map((row) => storeKey(row)));
+    return [...rows.values()].filter((row) => !keys.has(storeKey(row)));
+  };
+
   // The same guard the read path applies: on a tenant-scoped entity an id alone is not enough
   // to name a row, so `update`/`delete` resolve through a plan rather than through the map.
   const addressed = (id: string, options: RepoOptions | undefined, operation: string): Row => {
@@ -310,12 +313,7 @@ export const memoryRepo = <Row>(
 
     async update(id, patch, options) {
       const current = addressed(id, options, 'update');
-      return write(
-        Object.assign({}, current, defined(patch)),
-        options,
-        'update',
-        storeKey(current),
-      );
+      return write(mergedRow(entity, current, patch), options, 'update', storeKey(current));
     },
 
     async delete(id, options) {
@@ -379,8 +377,14 @@ export const memoryRepo = <Row>(
       if (hasJsOnlyInvariant(entity.$invariants) && found.length > MAX_ASSERTED_ROWS) {
         throw assertedRowsTooMany(entity.$name, 'updateWhere', found.length);
       }
-      for (const row of found)
-        write(Object.assign({}, row, defined(patch)), options, 'updateWhere', storeKey(row));
+      // The WHOLE batch is judged before any row of it lands — the same statement Postgres sends,
+      // which refuses as one. A row this batch refuses used to leave the rows before it stored:
+      // the write was a loop, and the loop stopped half way through. Postgres rolls that
+      // statement back; here nothing was written yet, so nothing has to be undone.
+      const merged = judgeUpdate(entity, found, patch, untouched(found), storeKey);
+      for (const [position, row] of merged.entries()) {
+        write(row, options, 'updateWhere', storeKey(found[position]));
+      }
       return found.length;
     },
 

package/src/memory-update.ts

@@ -0,0 +1,79 @@
+// Single responsibility: the memory driver's UPDATE — the merge of a patch into a row, and the
+// judgement of a filtered update's whole result before any of it lands.
+//
+// Postgres refuses such a write as ONE statement: the rows come back from `update … returning *`,
+// the app judges them, and a rule only the app can judge refuses the statement, so the
+// transaction holding both takes the write with it (`judged-write.ts`). The in-memory driver wrote
+// row by row, so a row refused half way through left the rows before it stored: one call, two
+// answers — a test over the memory driver saw a partial write, and production rolled it back.
+
+import { narrowRow } from './columns';
+import type { EntityCore } from './entity';
+import { uniqueClash, uniqueViolation } from './memory-unique';
+import { assertRowTenant } from './tenancy';
+
+/**
+ * The patch with every `undefined` property dropped — `bindValues` skips them in Postgres, so a
+ * patch built from optional input (`{ body: input.body }`) leaves the column alone in both drivers
+ * rather than erasing it. `null` is the value that clears a column.
+ */
+const defined = (patch: object): object =>
+  Object.fromEntries(Object.entries(patch).filter(([, value]) => value !== undefined));
+
+/**
+ * The row a patch makes of a stored one: the patch's values over the row's own, narrowed to what
+ * the store holds.
+ *
+ * Narrowed HERE, at the merge, because `$assert` judges the merged row and a money column's
+ * `bigint` minor unit has to be the `number` the row will hold. `insertAll` narrows twice for the
+ * same reason (`memory-repo.ts`), and narrowing twice is harmless: the second pass finds nothing
+ * left to change.
+ */
+export const mergedRow = <Row>(entity: EntityCore<Row>, row: Row, patch: object): Row =>
+  narrowRow<Row>(entity.$columns, Object.assign({}, row, defined(patch)));
+
+/**
+ * The rows a filtered update would write, judged as ONE batch: the patch merged into every
+ * matched row, and every result judged against the rows this write does not touch and against the
+ * results this same batch has already judged.
+ *
+ * `untouched` are the stored rows the filter did not match — including the rows of another tenant
+ * and the soft-deleted ones, because the unique index in Postgres covers those too. `key` is the
+ * key the store files a row under, handed in because that is the store's rule and this module must
+ * not spell it a second time.
+ *
+ * The judgement is the whole batch's, so a refusal lands before anything is stored — the shape
+ * `insertAll` already has, and the shape Postgres gives the statement it refuses.
+ */
+export const judgeUpdate = <Row>(
+  entity: EntityCore<Row>,
+  matched: readonly Row[],
+  patch: object,
+  untouched: readonly Row[],
+  key: (row: unknown) => string,
+): readonly Row[] => {
+  const judged: Row[] = [];
+  const judgedKeys = new Set<string>();
+  const untouchedKeys = new Set(untouched.map((row) => key(row)));
+  for (const row of matched) {
+    const result = mergedRow(entity, row, patch);
+    // The same four judgements `write` makes, in the same order — on the merged row rather than
+    // on the patch, and on the whole batch rather than on the row that happens to come first.
+    assertRowTenant(entity.$name, entity.$tenantColumn, 'updateWhere', result);
+    entity.$assert(result);
+    // The primary key: a result may not land on a key another row holds — neither one this write
+    // does not touch, nor one an earlier result of this same batch took. A row's OWN old version
+    // is not among them: it is the row this result replaces, and it never collides with itself.
+    const resultKey = key(result);
+    if (untouchedKeys.has(resultKey) || judgedKeys.has(resultKey)) {
+      throw uniqueViolation(entity, `${entity.$table}_pkey`);
+    }
+    // The unique constraints, against the same two sets. The rows this batch matched are not in
+    // either: each of them is replaced by its own result, which is judged here instead.
+    const clash = uniqueClash(entity, result, [...untouched, ...judged]);
+    if (clash !== undefined) throw uniqueViolation(entity, clash);
+    judged.push(result);
+    judgedKeys.add(resultKey);
+  }
+  return judged;
+};