@vantreeseba/drizzle-graphql 15.1.0 → 15.1.1

package/README.md

@@ -1042,6 +1042,11 @@ The pattern operators are `like` / `notLike` / `ilike` / `notIlike`, the safe
 `startsWith` / `endsWith` / `contains` and their `i`-prefixed forms, plus the `insensitive`
 flag that modifies them.
 
+An operand of `null` leaves its operator out, as though it had not been sent. `false` is an
+ordinary value: `active: { eq: false }` matches the rows that are false, `ne: false` the rows
+that are true, and `has: false` the arrays holding a `false`. Only the flag operators —
+`isNull`, `isNotNull` and `isEmpty` — read `false` as "add no condition".
+
 The omissions are the cases where the operator cannot ask anything a caller means:
 
 -   **Pattern matching a timestamp, a boolean or an enum member** compares whatever the value
@@ -1479,7 +1484,12 @@ field, and passing it back as `after` resumes strictly after that row.
     in `asc`), MySQL and SQLite smallest (first in `asc`). The predicate matches either way,
     so rows with `NULL` in an ordered column are paged through, not skipped, and `nulls` is
     part of the ordering a cursor is tied to
--   Dates and bigints round-trip losslessly through the cursor
+-   Dates and bigints round-trip losslessly through the cursor, at the column's own precision:
+    a PostgreSQL `timestamp` / `timestamptz` (microseconds unless declared `precision: 3` or
+    less) or a MySQL `datetime` / `timestamp` with `fsp` above 3 holds more than the
+    millisecond JS `Date` that `mode: 'date'` reads it into, so the cursor carries the
+    database's own text of the value instead, and rows a microsecond apart are still distinct
+    pages
 -   A cursor is only valid under the ordering it was issued for — reusing it with a
     different `orderBy` (or a malformed/corrupted cursor) returns a `GraphQLError`
 -   `after` cannot be combined with `distinct`, with `matchFilterOrder`, or with an `orderBy`
@@ -1891,6 +1901,10 @@ Two details worth stating plainly:
 -   **A rejection is the default because truncation lies.** Silently cutting a page down to
     `maxLimit` tells a paginating client it has reached the end when it has not. `clampToMax:
     true` opts into that when you would rather never fail a query.
+-   **A negative `limit` or `offset` is always rejected** with `DRIZZLE_INVALID_INPUT_VALUE`,
+    whether or not `limits` is configured — on root lists, single queries, relation fields and
+    `resolveSelection`. SQLite reads `LIMIT -1` as "no limit", so a negative value would
+    otherwise walk straight past `maxLimit`; `0` stays valid and returns no rows.
 
 The policy applies to root list queries and to to-many relation fields, on both the eager and
 the lazy relation paths. A relation takes the policy of the table it *reads*, not its parent's:
@@ -2114,7 +2128,8 @@ to match on prose:
     `DrizzleErrorContext`.
 
 A value the request could not supply is `DRIZZLE_INVALID_INPUT_VALUE` — a date that does not
-parse, a `BigInt` argument that is not an integer, a malformed JSON column value — and a write
+parse, a `BigInt` argument that is not an integer, a malformed JSON column value, a negative
+`limit` or `offset` — and a write
 naming something that is not a column of its table is `DRIZZLE_UNKNOWN_COLUMN`. The mirror
 image, a stored value the scalar transporting it cannot represent, is
 `DRIZZLE_UNREPRESENTABLE_VALUE`; it says the data is out of range, not that the request was

package/dist/index.cjs

@@ -1616,13 +1616,20 @@ const nullableOps = {
 	isNull: drizzle_orm.isNull,
 	isNotNull: drizzle_orm.isNotNull
 };
+/** Operators whose operand is an on/off flag rather than a value: `false` adds no condition. */
+const FLAG_OPERATORS = /* @__PURE__ */ new Set([
+	"isNull",
+	"isNotNull",
+	"isEmpty"
+]);
 const extractFiltersColumn = (column, columnName, operators) => {
 	const { OR, AND, NOT, insensitive, ...restOperators } = operators;
 	const foldCase = insensitive === true;
 	const entries = Object.entries(restOperators);
 	const variants = [];
 	for (const [operatorName, operatorValue] of entries) {
-		if (operatorValue === null || operatorValue === false) continue;
+		if (operatorValue === null || operatorValue === void 0) continue;
+		if (operatorValue === false && FLAG_OPERATORS.has(operatorName)) continue;
 		if (operatorName in singleValueOps) {
 			const singleValue = remapFromGraphQLCore(operatorValue, column, columnName);
 			variants.push(foldCase ? lowerComparison(column, operatorName, singleValue) : singleValueOps[operatorName](column, singleValue));
@@ -2756,6 +2763,45 @@ const cursorOrderExprs = (table, entries) => {
 	return entries.flatMap(([column, direction, nulls]) => orderExpressions(cols[column], direction, nulls ?? void 0, cols[column]));
 };
 /**
+* Property a row carries an ordering column's full-precision text under, when the column holds
+* more than a JS Date can. Namespaced like {@link ROW_CURSOR_PROP}, and removed from the row
+* once its cursor is encoded.
+*/
+const preciseTextProp = (column) => `__drizzle_graphql_cursor_text_${column}`;
+/**
+* Whether a column reads into a JS Date (milliseconds) while the database keeps finer
+* fractional seconds: a PostgreSQL `timestamp` / `timestamptz` in `mode: 'date'` (precision 6
+* unless it says otherwise) or a MySQL `datetime` / `timestamp` in `mode: 'date'` with
+* `fsp` above 3. String-mode columns already arrive as the database's own text, and `time` is
+* always a string, so neither loses anything.
+*/
+const outgrowsJsDate = (column) => {
+	if ((0, drizzle_orm.is)(column, drizzle_orm_pg_core.PgTimestamp)) return column.precision === void 0 || column.precision > 3;
+	if ((0, drizzle_orm.is)(column, drizzle_orm_mysql_core.MySqlDateTime) || (0, drizzle_orm.is)(column, drizzle_orm_mysql_core.MySqlTimestamp)) return (column.fsp ?? 0) > 3;
+	return false;
+};
+/**
+* Extra SQL expressions a cursor-computing query selects alongside the row: for each ordering
+* column whose values a JS Date would truncate, the value as the database's own text. The
+* cursor then encodes that text rather than the Date, and `after` compares the column against
+* it — so two rows a microsecond apart stay distinct positions. `table` may be the aliased RQB
+* proxy. Empty when no ordering column needs it.
+*/
+const cursorPreciseExtras = (table, entries) => {
+	const cols = (0, drizzle_orm.getColumns)(table);
+	const extras = {};
+	for (const [name] of entries) {
+		const column = cols[name];
+		if (column && outgrowsJsDate(column)) extras[preciseTextProp(name)] = (0, drizzle_orm.is)(column, drizzle_orm_pg_core.PgTimestamp) ? drizzle_orm.sql`${column}::text` : drizzle_orm.sql`cast(${column} as char)`;
+	}
+	return extras;
+};
+/**
+* {@link cursorPreciseExtras} aliased under their property names, for a `select({...})` that
+* may be wrapped in a subquery (where a bare SQL expression would have no name).
+*/
+const cursorPreciseSelection = (table, entries) => Object.fromEntries(Object.entries(cursorPreciseExtras(table, entries)).map(([prop, expression]) => [prop, expression.as(prop)]));
+/**
 * Serializes one ordering-tuple value into a JSON-safe shape. Dates and bigints don't survive
 * JSON.stringify losslessly (bigint throws, Date turns into an untagged string), so they are
 * tagged; decimals already arrive from the driver as strings, which are lossless as-is.
@@ -2790,7 +2836,11 @@ const cursorEncoder = (entries) => {
 	const spec = JSON.stringify(entries);
 	const columns = entries.map(([column]) => column);
 	return (row) => {
-		const values = JSON.stringify(columns.map((column) => encodeCursorValue(row[column] ?? null)));
+		const values = JSON.stringify(columns.map((column) => {
+			const value = row[column] ?? null;
+			const precise = row[preciseTextProp(column)];
+			return value !== null && typeof precise === "string" ? precise : encodeCursorValue(value);
+		}));
 		return Buffer.from(`{"o":${spec},"v":${values}}`, "utf8").toString("base64url");
 	};
 };
@@ -2883,7 +2933,11 @@ const selectsCursorField = (info, table) => {
 */
 const attachRowCursors = (rows, entries) => {
 	const encode = cursorEncoder(entries);
-	for (const row of rows) row[ROW_CURSOR_PROP] = encode(row);
+	const preciseProps = entries.map(([column]) => preciseTextProp(column));
+	for (const row of rows) {
+		row[ROW_CURSOR_PROP] = encode(row);
+		for (const prop of preciseProps) delete row[prop];
+	}
 };
 /** Resolver for the `cursor` meta field: reads the value a list resolver attached, if any. */
 const rowCursorResolver = (source) => source?.[ROW_CURSOR_PROP] ?? null;
@@ -3241,6 +3295,21 @@ const withDefaultOrderBy = (args, tableName, defaults) => {
 	} : args;
 };
 /**
+* Rejects a negative `limit` or `offset`. Neither is a page size or a position, and the
+* dialects disagree on what one means: SQLite reads `LIMIT -1` as "no limit" — which would walk
+* straight past `maxLimit` — while PostgreSQL and MySQL fail with a raw database error. Applied
+* whether or not the table has a limit policy.
+*/
+const assertPagingNotNegative = (paging, errorCtx) => {
+	for (const name of ["limit", "offset"]) {
+		const value = paging[name];
+		if (value != null && value < 0) throw drizzleError(`'${name}' must not be negative, got ${value}.`, {
+			code: "DRIZZLE_INVALID_INPUT_VALUE",
+			...errorCtx
+		});
+	}
+};
+/**
 * The `limit` a query actually runs with, given the policy for the table it reads.
 *
 * A request that passes no `limit` falls back to `defaultLimit`, or to `maxLimit` when only
@@ -3252,6 +3321,7 @@ const withDefaultOrderBy = (args, tableName, defaults) => {
 * fail a client's query over.
 */
 const applyLimitPolicy = (limit, policy, errorCtx) => {
+	assertPagingNotNegative({ limit }, errorCtx);
 	if (!policy) return limit ?? void 0;
 	const { defaultLimit, maxLimit, clampToMax } = policy;
 	if (limit == null) {
@@ -3769,6 +3839,11 @@ const extractRelationsParams = (relationMap, tables, tableName, info, typeName,
 		thisRecord.columns = columns;
 		const relationArgs = (0, drizzle_orm.is)(relEntry.relation, drizzle_orm.One) ? field.args : withDefaultOrderBy(field.args ?? {}, targetTableName, defaultOrderBy);
 		const offset = relationArgs?.offset ?? void 0;
+		assertPagingNotNegative({ offset }, {
+			table: targetTableName,
+			operation: "relation",
+			relation: relName
+		});
 		const limit = (0, drizzle_orm.is)(relEntry.relation, drizzle_orm.One) ? relationArgs?.limit ?? void 0 : applyLimitPolicy(relationArgs?.limit, limits?.(targetTableName), {
 			table: targetTableName,
 			operation: "relation",
@@ -3812,6 +3887,10 @@ const pruneNonEagerRelations = (relationMap, shouldEagerLoad) => {
 const runRelationalSelect = async (opts) => {
 	const { queryBase, tables, tableName, table, relationMap, typeName, typeNameMapper, parsedInfo, offset, orderBy, where, single, filterCtx, pkNames, after, scope, deleted } = opts;
 	const distinct = opts.distinct?.length ? opts.distinct : void 0;
+	assertPagingNotNegative({
+		limit: opts.limit,
+		offset
+	});
 	const cursorSelected = !single && isCursorFieldSelected(parsedInfo.fieldsByTypeName[typeName], table);
 	let cursorEntries;
 	if (!single && (after != null || cursorSelected)) {
@@ -3863,7 +3942,11 @@ const runRelationalSelect = async (opts) => {
 		const result = await queryBase.findFirst(omitUndefinedKeys(params));
 		return result ? remapToGraphQLSingleOutput(result, tableName, table, relationMap) : void 0;
 	}
-	if (cursorEntries && cursorSelected) for (const [column] of cursorEntries) params.columns[column] = true;
+	if (cursorEntries && cursorSelected) {
+		for (const [column] of cursorEntries) params.columns[column] = true;
+		const preciseProps = Object.keys(cursorPreciseExtras(table, cursorEntries));
+		if (preciseProps.length) params.extras = Object.fromEntries(preciseProps.map((prop) => [prop, (aliasedTable) => cursorPreciseExtras(aliasedTable, cursorEntries)[prop]]));
+	}
 	params.limit = distinctKeys ? void 0 : opts.limit;
 	const result = await queryBase.findMany(omitUndefinedKeys(params));
 	if (cursorEntries && cursorSelected) attachRowCursors(result, cursorEntries);
@@ -4767,7 +4850,10 @@ const createRelationResolverFactory = (db, tables, nullOrdering, filterCtx, limi
 			const column = targetColumns[columnName];
 			if (column) columns[columnName] = column;
 		}
-		return columns;
+		return cursorEntries ? {
+			...columns,
+			...cursorPreciseSelection(targetTable, cursorEntries)
+		} : columns;
 	};
 	const resolve = async (parent, args, context, info) => {
 		if (parent[relationName] !== void 0) return parent[relationName];
@@ -4777,6 +4863,7 @@ const createRelationResolverFactory = (db, tables, nullOrdering, filterCtx, limi
 		const { orderByArg, limit, distinct, cursorEntries, cursorValues, columns, loaderKey } = getOrCreateRequestValue(context, info?.fieldNodes?.[0], `relation:${tableName}::${relationName}`, () => {
 			const orderByArg = isOne ? args?.orderBy : withDefaultOrderBy(args ?? {}, targetTableName, policies?.defaultOrderBy).orderBy;
 			const limit = applyLimitPolicy(requestedLimit, limitPolicy, errorCtx);
+			assertPagingNotNegative({ offset }, errorCtx);
 			const distinct = (args ?? {}).distinct?.length ? (args ?? {}).distinct : void 0;
 			const cursorSelected = !isOne && !!info && selectsCursorField(info, targetTable);
 			let cursorEntries;