@vantreeseba/drizzle-graphql 7.0.0 → 7.1.0

package/dist/index.d.cts

@@ -239,7 +239,18 @@ declare const drizzleExecutorKey: unique symbol;
  * each dialect builder states it: `'nulls-largest'` for PostgreSQL, `'nulls-smallest'` for
  * MySQL and SQLite.
  */
-declare const createRelationResolverFactory: (db: any, tables: Record<string, Table>, nullOrdering: NullOrdering, filterCtx?: RelationFilterBase) => RelationResolverFactory;
+declare const createRelationResolverFactory: (db: any, tables: Record<string, Table>, nullOrdering: NullOrdering, filterCtx?: RelationFilterBase, limits?: LimitPolicyFor) => RelationResolverFactory;
+/** {@link BuildSchemaConfig.limits} resolved for one table. `undefined` means no policy. */
+type ResolvedLimitPolicy = {
+    defaultLimit: number | undefined;
+    maxLimit: number | undefined;
+    clampToMax: boolean;
+};
+/**
+ * Looks up the limit policy for a table by its Drizzle schema key. Built once per schema by
+ * `buildSchema`; `undefined` for a table the caller left unbounded.
+ */
+type LimitPolicyFor = (tableName: string) => ResolvedLimitPolicy | undefined;
 /**
  * Compiles an `orderBy` argument into ORDER BY expressions, highest priority first.
  *
@@ -760,6 +771,29 @@ type ComplexityConfig = {
      */
     aggregateCost?: number;
 };
+/**
+ * A limit policy: what a request without `limit` gets, and how large a `limit` may be.
+ * Every field is optional — an empty policy is the default unbounded behavior.
+ */
+type TableLimitPolicy = {
+    /** Applied when the client passes no `limit`. Capped by `maxLimit` when both are set. */
+    defaultLimit?: number;
+    /**
+     * The largest `limit` a client may ask for. Also bounds a request that passes no `limit` at
+     * all, since that means every row.
+     */
+    maxLimit?: number;
+    /**
+     * `false` (default) rejects a `limit` above `maxLimit` with a GraphQL error; `true` reduces
+     * it to `maxLimit` instead.
+     */
+    clampToMax?: boolean;
+};
+/** {@link BuildSchemaConfig.limits} — a global policy plus per-table overrides. */
+type LimitsConfig = TableLimitPolicy & {
+    /** Per-table overrides, keyed by the table's key in the Drizzle schema. */
+    tables?: Record<string, TableLimitPolicy>;
+};
 type BuildSchemaConfig = {
     /**
      * Determines whether generated mutations will be passed to returned schema.
@@ -911,6 +945,43 @@ type BuildSchemaConfig = {
         mode: 'auto';
         timeoutMs?: number;
     };
+    /**
+     * Bounds on the `limit` argument of list queries and to-many relation fields.
+     *
+     * Both knobs are off by default: without them a client can omit `limit` and pull a whole
+     * table, or pass `limit: 1000000` and do the same thing politely. Turning either on changes
+     * observable behavior for existing consumers, so nothing is applied unless asked for.
+     *
+     * ```ts
+     * buildSchema(db, {
+     *   limits: {
+     *     defaultLimit: 50,  // used when the client passes no `limit`
+     *     maxLimit: 500,     // anything above is rejected
+     *     tables: {
+     *       auditLog: { defaultLimit: 20, maxLimit: 100 },
+     *     },
+     *   },
+     * });
+     * ```
+     *
+     * - Applies to root list queries **and** to to-many relation fields — an unbounded relation
+     *   inside a bounded root is the same scan one level down. A relation field takes the policy
+     *   of the table it *targets*, so a table is bounded wherever it is reached from. Single-row
+     *   queries and aggregates take no `limit` and are unaffected.
+     * - A `limit` above `maxLimit` is rejected with a GraphQL error. Set `clampToMax: true` to
+     *   silently reduce it instead — honest paginating clients prefer the error, since a clamped
+     *   page looks like the end of the results.
+     * - `maxLimit` on its own also bounds the *omitted* case: no `limit` means every row, which
+     *   is above any maximum. `defaultLimit` is what a request without `limit` gets, capped by
+     *   `maxLimit` if both are set.
+     * - `tables` overrides per table, keyed by the Drizzle schema key. A table's entry replaces
+     *   the top-level value for whichever keys it sets.
+     * - Cursor pagination inherits the same policy — a keyset page needs a limit to be
+     *   meaningful, and `defaultLimit` is what makes `after`-only pagination well-formed.
+     * - The complexity hints price the *effective* limit, so cost estimation and enforcement
+     *   agree.
+     */
+    limits?: LimitsConfig;
     /**
      * Optional mapper from table key to singular/plural name pair.
      * When provided for a table, overrides the default (table key) naming for GraphQL type names,
@@ -1139,4 +1210,4 @@ declare const GraphQLDecimalString: GraphQLScalarType<string, string>;
 
 declare const buildSchema: <TDbClient extends AnyDrizzleDB<any>>(db: TDbClient, config?: BuildSchemaConfig) => GeneratedData<TDbClient>;
 
-export { type AggregateResolver, type AnyDrizzleDB, type BuildSchemaConfig, type ColumnDeprecator, type ColumnDescriber, type ColumnDocInfo, type ColumnTypeMapper, type ColumnTypeMapperInfo, type ComplexityConfig, type DeleteResolver, type DeleteSingleResolver, type EnumNameInfo, type EnumNameMapper, type ExtractRelations, type ExtractTableByName, type ExtractTableRelations, type ExtractTables, type GeneratedData, type GeneratedEntities, type GeneratedInputs, type GeneratedOutputs, GraphQLBigIntString, GraphQLDecimalString, type InsertArrResolver, type InsertResolver, type MutationReturnlessResult, type MutationsCore, type QueriesCore, type RelationDescriber, type RelationResolverFactory, type ScalarOverride, type ScalarOverridesConfig, type SchemaDocs, type SchemaFeatures, type SelectResolver, type SelectSingleResolver, type TableDescriber, type TableNamedRelations, type UpdateManyArgs, type UpdateManyEntry, type UpdateManyResolver, type UpdateResolver, type UpdateSingleResolver, type UpsertArgs, type UpsertArrResolver, type UpsertConflictArgs, type UpsertResolver, buildSchema, createRelationResolverFactory, defaultErrorMapper, drizzleExecutorKey, extractFilters, extractOrderBy, extractRelationJoinColumns };
+export { type AggregateResolver, type AnyDrizzleDB, type BuildSchemaConfig, type ColumnDeprecator, type ColumnDescriber, type ColumnDocInfo, type ColumnTypeMapper, type ColumnTypeMapperInfo, type ComplexityConfig, type DeleteResolver, type DeleteSingleResolver, type EnumNameInfo, type EnumNameMapper, type ExtractRelations, type ExtractTableByName, type ExtractTableRelations, type ExtractTables, type GeneratedData, type GeneratedEntities, type GeneratedInputs, type GeneratedOutputs, GraphQLBigIntString, GraphQLDecimalString, type InsertArrResolver, type InsertResolver, type LimitsConfig, type MutationReturnlessResult, type MutationsCore, type QueriesCore, type RelationDescriber, type RelationResolverFactory, type ScalarOverride, type ScalarOverridesConfig, type SchemaDocs, type SchemaFeatures, type SelectResolver, type SelectSingleResolver, type TableDescriber, type TableLimitPolicy, type TableNamedRelations, type UpdateManyArgs, type UpdateManyEntry, type UpdateManyResolver, type UpdateResolver, type UpdateSingleResolver, type UpsertArgs, type UpsertArrResolver, type UpsertConflictArgs, type UpsertResolver, buildSchema, createRelationResolverFactory, defaultErrorMapper, drizzleExecutorKey, extractFilters, extractOrderBy, extractRelationJoinColumns };

package/dist/index.d.ts

@@ -239,7 +239,18 @@ declare const drizzleExecutorKey: unique symbol;
  * each dialect builder states it: `'nulls-largest'` for PostgreSQL, `'nulls-smallest'` for
  * MySQL and SQLite.
  */
-declare const createRelationResolverFactory: (db: any, tables: Record<string, Table>, nullOrdering: NullOrdering, filterCtx?: RelationFilterBase) => RelationResolverFactory;
+declare const createRelationResolverFactory: (db: any, tables: Record<string, Table>, nullOrdering: NullOrdering, filterCtx?: RelationFilterBase, limits?: LimitPolicyFor) => RelationResolverFactory;
+/** {@link BuildSchemaConfig.limits} resolved for one table. `undefined` means no policy. */
+type ResolvedLimitPolicy = {
+    defaultLimit: number | undefined;
+    maxLimit: number | undefined;
+    clampToMax: boolean;
+};
+/**
+ * Looks up the limit policy for a table by its Drizzle schema key. Built once per schema by
+ * `buildSchema`; `undefined` for a table the caller left unbounded.
+ */
+type LimitPolicyFor = (tableName: string) => ResolvedLimitPolicy | undefined;
 /**
  * Compiles an `orderBy` argument into ORDER BY expressions, highest priority first.
  *
@@ -760,6 +771,29 @@ type ComplexityConfig = {
      */
     aggregateCost?: number;
 };
+/**
+ * A limit policy: what a request without `limit` gets, and how large a `limit` may be.
+ * Every field is optional — an empty policy is the default unbounded behavior.
+ */
+type TableLimitPolicy = {
+    /** Applied when the client passes no `limit`. Capped by `maxLimit` when both are set. */
+    defaultLimit?: number;
+    /**
+     * The largest `limit` a client may ask for. Also bounds a request that passes no `limit` at
+     * all, since that means every row.
+     */
+    maxLimit?: number;
+    /**
+     * `false` (default) rejects a `limit` above `maxLimit` with a GraphQL error; `true` reduces
+     * it to `maxLimit` instead.
+     */
+    clampToMax?: boolean;
+};
+/** {@link BuildSchemaConfig.limits} — a global policy plus per-table overrides. */
+type LimitsConfig = TableLimitPolicy & {
+    /** Per-table overrides, keyed by the table's key in the Drizzle schema. */
+    tables?: Record<string, TableLimitPolicy>;
+};
 type BuildSchemaConfig = {
     /**
      * Determines whether generated mutations will be passed to returned schema.
@@ -911,6 +945,43 @@ type BuildSchemaConfig = {
         mode: 'auto';
         timeoutMs?: number;
     };
+    /**
+     * Bounds on the `limit` argument of list queries and to-many relation fields.
+     *
+     * Both knobs are off by default: without them a client can omit `limit` and pull a whole
+     * table, or pass `limit: 1000000` and do the same thing politely. Turning either on changes
+     * observable behavior for existing consumers, so nothing is applied unless asked for.
+     *
+     * ```ts
+     * buildSchema(db, {
+     *   limits: {
+     *     defaultLimit: 50,  // used when the client passes no `limit`
+     *     maxLimit: 500,     // anything above is rejected
+     *     tables: {
+     *       auditLog: { defaultLimit: 20, maxLimit: 100 },
+     *     },
+     *   },
+     * });
+     * ```
+     *
+     * - Applies to root list queries **and** to to-many relation fields — an unbounded relation
+     *   inside a bounded root is the same scan one level down. A relation field takes the policy
+     *   of the table it *targets*, so a table is bounded wherever it is reached from. Single-row
+     *   queries and aggregates take no `limit` and are unaffected.
+     * - A `limit` above `maxLimit` is rejected with a GraphQL error. Set `clampToMax: true` to
+     *   silently reduce it instead — honest paginating clients prefer the error, since a clamped
+     *   page looks like the end of the results.
+     * - `maxLimit` on its own also bounds the *omitted* case: no `limit` means every row, which
+     *   is above any maximum. `defaultLimit` is what a request without `limit` gets, capped by
+     *   `maxLimit` if both are set.
+     * - `tables` overrides per table, keyed by the Drizzle schema key. A table's entry replaces
+     *   the top-level value for whichever keys it sets.
+     * - Cursor pagination inherits the same policy — a keyset page needs a limit to be
+     *   meaningful, and `defaultLimit` is what makes `after`-only pagination well-formed.
+     * - The complexity hints price the *effective* limit, so cost estimation and enforcement
+     *   agree.
+     */
+    limits?: LimitsConfig;
     /**
      * Optional mapper from table key to singular/plural name pair.
      * When provided for a table, overrides the default (table key) naming for GraphQL type names,
@@ -1139,4 +1210,4 @@ declare const GraphQLDecimalString: GraphQLScalarType<string, string>;
 
 declare const buildSchema: <TDbClient extends AnyDrizzleDB<any>>(db: TDbClient, config?: BuildSchemaConfig) => GeneratedData<TDbClient>;
 
-export { type AggregateResolver, type AnyDrizzleDB, type BuildSchemaConfig, type ColumnDeprecator, type ColumnDescriber, type ColumnDocInfo, type ColumnTypeMapper, type ColumnTypeMapperInfo, type ComplexityConfig, type DeleteResolver, type DeleteSingleResolver, type EnumNameInfo, type EnumNameMapper, type ExtractRelations, type ExtractTableByName, type ExtractTableRelations, type ExtractTables, type GeneratedData, type GeneratedEntities, type GeneratedInputs, type GeneratedOutputs, GraphQLBigIntString, GraphQLDecimalString, type InsertArrResolver, type InsertResolver, type MutationReturnlessResult, type MutationsCore, type QueriesCore, type RelationDescriber, type RelationResolverFactory, type ScalarOverride, type ScalarOverridesConfig, type SchemaDocs, type SchemaFeatures, type SelectResolver, type SelectSingleResolver, type TableDescriber, type TableNamedRelations, type UpdateManyArgs, type UpdateManyEntry, type UpdateManyResolver, type UpdateResolver, type UpdateSingleResolver, type UpsertArgs, type UpsertArrResolver, type UpsertConflictArgs, type UpsertResolver, buildSchema, createRelationResolverFactory, defaultErrorMapper, drizzleExecutorKey, extractFilters, extractOrderBy, extractRelationJoinColumns };
+export { type AggregateResolver, type AnyDrizzleDB, type BuildSchemaConfig, type ColumnDeprecator, type ColumnDescriber, type ColumnDocInfo, type ColumnTypeMapper, type ColumnTypeMapperInfo, type ComplexityConfig, type DeleteResolver, type DeleteSingleResolver, type EnumNameInfo, type EnumNameMapper, type ExtractRelations, type ExtractTableByName, type ExtractTableRelations, type ExtractTables, type GeneratedData, type GeneratedEntities, type GeneratedInputs, type GeneratedOutputs, GraphQLBigIntString, GraphQLDecimalString, type InsertArrResolver, type InsertResolver, type LimitsConfig, type MutationReturnlessResult, type MutationsCore, type QueriesCore, type RelationDescriber, type RelationResolverFactory, type ScalarOverride, type ScalarOverridesConfig, type SchemaDocs, type SchemaFeatures, type SelectResolver, type SelectSingleResolver, type TableDescriber, type TableLimitPolicy, type TableNamedRelations, type UpdateManyArgs, type UpdateManyEntry, type UpdateManyResolver, type UpdateResolver, type UpdateSingleResolver, type UpsertArgs, type UpsertArrResolver, type UpsertConflictArgs, type UpsertResolver, buildSchema, createRelationResolverFactory, defaultErrorMapper, drizzleExecutorKey, extractFilters, extractOrderBy, extractRelationJoinColumns };