@vantreeseba/drizzle-graphql 7.4.0 → 7.6.0

package/README.md

@@ -237,6 +237,96 @@ table becomes readable but not insertable — and warns on the console, since th
 often a mistake than a plan.
 
 > `exclude` is a static decision: the column is absent for every caller. Deciding per
+> request *which fields* a caller may reach is a job for
+> [`graphql-shield`](https://the-guild.dev/graphql/shield) or an equivalent layer above the
+> schema. Deciding per request *which rows* a caller may reach is `scope`, below — that one a
+> layer above cannot do, because a nested relation field never passes through a root resolver.
+
+## Row scoping and multi-tenancy
+
+`scope` attaches a predicate, derived from the request context, to every read and write of a
+table:
+
+```Typescript
+import { and, eq } from 'drizzle-orm'
+
+const { schema } = buildSchema(db, {
+    scope: {
+        posts: (ctx, table) => eq(table.orgId, ctx.orgId),
+        // A filter object works too — same shape as the generated `where` argument:
+        comments: (ctx) => ({ post: { orgId: { eq: ctx.orgId } } }),
+    },
+})
+```
+
+Keyed by the **Drizzle schema key**. `ctx` is your GraphQL context value; `table` is the table
+the current statement runs against — for a relational read that is Drizzle's *aliased* copy, so
+always build the predicate from that argument rather than from the imported table object.
+
+The predicate is ANDed on **last**, after whatever the client sent, so a client filter can only
+narrow the scope, never widen it. It reaches every path that touches the table:
+
+| Path | Effect |
+| --- | --- |
+| `posts`, `postsSingle` | out-of-scope rows are not returned |
+| `postsAggregate`, `postsGroupBy` | counted over in-scope rows only |
+| `user.posts`, `user.postsAggregate` | scoped on both the batched and the eager (`with:`) path |
+| cursor pages | the keyset page is taken within the scope |
+| `updatePosts`, `updatePostsMany`, `deletePosts` | an out-of-scope row is simply not matched |
+| `upsertPosts` (conflict branch) | a conflicting row outside the scope is left alone, not taken over |
+| nested `connect` / `disconnect` / `set` | only in-scope rows can be attached or detached |
+
+Two things it deliberately does not do:
+
+-   **It does not refuse.** A scoped `deletePosts(where: { id: { eq: 4 } })` on another
+    tenant's row returns `[]`, the same answer as a row that does not exist. Telling the caller
+    "that row exists but is not yours" is the leak the scope is there to close.
+-   **It does not apply to a plain insert.** There is no existing row to filter. `contextValues`
+    is the write-side half.
+
+Returning `undefined` means *no restriction for this context*, so one hook can let an
+administrator through:
+
+```Typescript
+scope: {
+    posts: (ctx, table) => (ctx.isAdmin ? undefined : eq(table.orgId, ctx.orgId)),
+}
+```
+
+A table with no entry is unscoped, and a build with no `scope` at all emits exactly the SQL it
+did before.
+
+### Columns the server owns
+
+`contextValues` supplies a column's value from the request context instead of accepting it from
+the client:
+
+```Typescript
+const { schema } = buildSchema(db, {
+    contextValues: {
+        posts: {
+            orgId: (ctx) => ctx.orgId,
+            authorId: (ctx) => ctx.userId,
+        },
+    },
+})
+```
+
+-   The column is **removed from `CreatePostsInput` and `UpdatePostsInput`**, so a client cannot
+    send it at all — the SDL itself says the column is server-owned. It stays readable on the
+    object type.
+-   Every insert stamps it, including rows created by a nested `create`.
+-   Updates never write it, so an update cannot hand a row to another owner.
+
+Together the two close the loop: `contextValues` decides which tenant a new row belongs to, and
+`scope` decides which rows a request can see and change afterwards.
+
+> **MySQL caveat.** `ON DUPLICATE KEY UPDATE` takes no predicate, so a MySQL upsert's conflict
+> branch cannot be scoped. Scope the table's `update` and rely on `contextValues` for the insert
+> half.
+
+Names that match nothing throw at build time, the same as `exclude` — a renamed column fails the
+build instead of quietly ceasing to be scoped.
 > request who may see what is a job for [`graphql-shield`](https://the-guild.dev/graphql/shield)
 > or an equivalent layer above the schema, which has the request context this library
 > does not.
@@ -1487,6 +1577,105 @@ request-scoped batch loader, so the field still works even before you override i
 and relation names are the Drizzle schema keys (e.g. `Users`, `posts`), matching the keys
 of `entities.fieldResolvers`.
 
+## Writing your own resolver over a generated type
+
+When you replace or wrap a generated resolver — to add a permission check that needs the
+row, to run a write inside your own transaction, to enforce a rule the schema cannot
+express — you become responsible for returning a row shaped like the type you replaced.
+That means translating the GraphQL selection set into the relational query builder's
+`with:` tree: relation field resolvers only fill in relations the parent did not already
+provide.
+
+Two exports do that for you, alongside the already-exported `extractFilters` and
+`extractOrderBy`:
+
+```Typescript
+import { resolveSelection, selectionToWith } from '@vantreeseba/drizzle-graphql'
+
+// The whole read: selected columns, relation arguments, eager loading, cursor
+// pagination, and the transport remapping of the result — against any executor.
+const rows = await resolveSelection(info, {
+    db,
+    table: 'Users',
+    where: { id: { eq: userId } },
+    executor: tx, // defaults to `db`; pass a transaction to see its own writes
+})
+
+// Or just the `with:` tree, if you are building the query yourself.
+const withTree = selectionToWith(info, { db, table: 'Users' })
+const row = await tx.query.Users.findFirst({ where: { id: userId }, with: withTree })
+```
+
+`selectionToWith` resolves fragments and inline fragments against `info.fragments`,
+intersects the selection against the relations config (so scalars and any fields you added
+yourself drop out instead of becoming invalid `with:` keys), follows aliases back to the
+relation they select, compiles each relation's `where` / `orderBy` / `limit` / `offset`
+into its nested entry, and leaves `<relation>Aggregate` selections out — they are not
+`with:` entries. It returns `undefined` when the selection asks for no relations.
+
+`resolveSelection` additionally accepts `single`, `orderBy`, `limit`, `offset` and `after`,
+and returns the rows already remapped to their GraphQL transport forms.
+
+Both take a `typeNameMapper` option. If the schema was built with one, pass the same
+function here — the translation matches selections against GraphQL type names, so a build
+that renames its types has to say so.
+
+## Identifying generated fields
+
+Every generated field and object type publishes what it is under `extensions.drizzle`, so
+wrappers — `graphql-middleware`, envelop, `graphql-shield`, an audit log, a cache
+invalidator — can ask the schema instead of parsing field names. Names are configurable
+(`prefixes`, `suffixes`, `typeNameMapper`), which makes name parsing ambiguous by
+construction; this is not.
+
+```Typescript
+import { drizzleExtension, identifyRows } from '@vantreeseba/drizzle-graphql'
+
+const field = info.parentType.getFields()[info.fieldName]
+const meta = drizzleExtension(field)
+// {
+//   table: 'Users',        // the Drizzle schema key
+//   kind: 'mutation',      // 'query' | 'mutation' | 'relation' | 'aggregate' | 'type'
+//   operation: 'update',   // 'select' | 'insert' | 'update' | 'updateMany' | 'upsert'
+//                          // | 'delete' | 'aggregate' | 'groupBy' | 'relation'
+//                          // | 'relationAggregate'
+//   single: true,          // one row, or a list
+//   targetArg: 'where',    // 'where' | 'values' | 'updates' — where the rows live
+//   primaryKey: ['id'],    // key columns of `table`, in schema order
+// }
+
+if (meta?.kind === 'mutation') await audit(meta.table, meta.operation, args[meta.targetArg])
+```
+
+`drizzleExtension` returns `undefined` for anything this library did not generate, which is
+the check to make before treating a field as one of ours. Relation fields (and
+`<relation>Aggregate` fields) additionally carry `relation` and `parentTable`, with `table`
+naming the relation's **target** — so `Users.posts` reads as
+`{ table: 'Posts', parentTable: 'Users', relation: 'posts' }`. Object types carry
+`{ table, kind: 'type', primaryKey }`, which is what a stitching layer needs to map a type
+back to its source.
+
+Because the row identity of a mutation lives in a different argument for every operation,
+`identifyRows` reads whichever one applies and hands back primary-key values:
+
+```Typescript
+const target = identifyRows(field, args)
+// { table: 'Users', primaryKey: ['id'], rows: [{ id: 3 }], complete: true }
+
+if (target?.complete) await invalidate(target.table, target.rows)
+```
+
+It understands `values` (one object or a list), `where` (`eq` for one row, `inArray` for
+many, an equality on every column of a composite key), and the per-entry `where` inside a
+batch update's `updates`. Check `complete` before treating `rows` as the affected set: it
+is `false` when the arguments do not pin the rows down — an insert whose key the database
+generates, a filter on something other than the primary key, an unbounded update, or a
+table with no primary key at all.
+
+> [!NOTE]
+> `extensions.drizzle` is stable API. The point of publishing it is that consumers stop
+> parsing names, which only holds if the shape does not move: fields are added to it, never
+> removed or repurposed.
 ## Configuration reference
 
 Every key of the second argument to `buildSchema(db, config?)`. Each links to the section

package/dist/README.md

@@ -237,6 +237,96 @@ table becomes readable but not insertable — and warns on the console, since th
 often a mistake than a plan.
 
 > `exclude` is a static decision: the column is absent for every caller. Deciding per
+> request *which fields* a caller may reach is a job for
+> [`graphql-shield`](https://the-guild.dev/graphql/shield) or an equivalent layer above the
+> schema. Deciding per request *which rows* a caller may reach is `scope`, below — that one a
+> layer above cannot do, because a nested relation field never passes through a root resolver.
+
+## Row scoping and multi-tenancy
+
+`scope` attaches a predicate, derived from the request context, to every read and write of a
+table:
+
+```Typescript
+import { and, eq } from 'drizzle-orm'
+
+const { schema } = buildSchema(db, {
+    scope: {
+        posts: (ctx, table) => eq(table.orgId, ctx.orgId),
+        // A filter object works too — same shape as the generated `where` argument:
+        comments: (ctx) => ({ post: { orgId: { eq: ctx.orgId } } }),
+    },
+})
+```
+
+Keyed by the **Drizzle schema key**. `ctx` is your GraphQL context value; `table` is the table
+the current statement runs against — for a relational read that is Drizzle's *aliased* copy, so
+always build the predicate from that argument rather than from the imported table object.
+
+The predicate is ANDed on **last**, after whatever the client sent, so a client filter can only
+narrow the scope, never widen it. It reaches every path that touches the table:
+
+| Path | Effect |
+| --- | --- |
+| `posts`, `postsSingle` | out-of-scope rows are not returned |
+| `postsAggregate`, `postsGroupBy` | counted over in-scope rows only |
+| `user.posts`, `user.postsAggregate` | scoped on both the batched and the eager (`with:`) path |
+| cursor pages | the keyset page is taken within the scope |
+| `updatePosts`, `updatePostsMany`, `deletePosts` | an out-of-scope row is simply not matched |
+| `upsertPosts` (conflict branch) | a conflicting row outside the scope is left alone, not taken over |
+| nested `connect` / `disconnect` / `set` | only in-scope rows can be attached or detached |
+
+Two things it deliberately does not do:
+
+-   **It does not refuse.** A scoped `deletePosts(where: { id: { eq: 4 } })` on another
+    tenant's row returns `[]`, the same answer as a row that does not exist. Telling the caller
+    "that row exists but is not yours" is the leak the scope is there to close.
+-   **It does not apply to a plain insert.** There is no existing row to filter. `contextValues`
+    is the write-side half.
+
+Returning `undefined` means *no restriction for this context*, so one hook can let an
+administrator through:
+
+```Typescript
+scope: {
+    posts: (ctx, table) => (ctx.isAdmin ? undefined : eq(table.orgId, ctx.orgId)),
+}
+```
+
+A table with no entry is unscoped, and a build with no `scope` at all emits exactly the SQL it
+did before.
+
+### Columns the server owns
+
+`contextValues` supplies a column's value from the request context instead of accepting it from
+the client:
+
+```Typescript
+const { schema } = buildSchema(db, {
+    contextValues: {
+        posts: {
+            orgId: (ctx) => ctx.orgId,
+            authorId: (ctx) => ctx.userId,
+        },
+    },
+})
+```
+
+-   The column is **removed from `CreatePostsInput` and `UpdatePostsInput`**, so a client cannot
+    send it at all — the SDL itself says the column is server-owned. It stays readable on the
+    object type.
+-   Every insert stamps it, including rows created by a nested `create`.
+-   Updates never write it, so an update cannot hand a row to another owner.
+
+Together the two close the loop: `contextValues` decides which tenant a new row belongs to, and
+`scope` decides which rows a request can see and change afterwards.
+
+> **MySQL caveat.** `ON DUPLICATE KEY UPDATE` takes no predicate, so a MySQL upsert's conflict
+> branch cannot be scoped. Scope the table's `update` and rely on `contextValues` for the insert
+> half.
+
+Names that match nothing throw at build time, the same as `exclude` — a renamed column fails the
+build instead of quietly ceasing to be scoped.
 > request who may see what is a job for [`graphql-shield`](https://the-guild.dev/graphql/shield)
 > or an equivalent layer above the schema, which has the request context this library
 > does not.
@@ -1487,6 +1577,105 @@ request-scoped batch loader, so the field still works even before you override i
 and relation names are the Drizzle schema keys (e.g. `Users`, `posts`), matching the keys
 of `entities.fieldResolvers`.
 
+## Writing your own resolver over a generated type
+
+When you replace or wrap a generated resolver — to add a permission check that needs the
+row, to run a write inside your own transaction, to enforce a rule the schema cannot
+express — you become responsible for returning a row shaped like the type you replaced.
+That means translating the GraphQL selection set into the relational query builder's
+`with:` tree: relation field resolvers only fill in relations the parent did not already
+provide.
+
+Two exports do that for you, alongside the already-exported `extractFilters` and
+`extractOrderBy`:
+
+```Typescript
+import { resolveSelection, selectionToWith } from '@vantreeseba/drizzle-graphql'
+
+// The whole read: selected columns, relation arguments, eager loading, cursor
+// pagination, and the transport remapping of the result — against any executor.
+const rows = await resolveSelection(info, {
+    db,
+    table: 'Users',
+    where: { id: { eq: userId } },
+    executor: tx, // defaults to `db`; pass a transaction to see its own writes
+})
+
+// Or just the `with:` tree, if you are building the query yourself.
+const withTree = selectionToWith(info, { db, table: 'Users' })
+const row = await tx.query.Users.findFirst({ where: { id: userId }, with: withTree })
+```
+
+`selectionToWith` resolves fragments and inline fragments against `info.fragments`,
+intersects the selection against the relations config (so scalars and any fields you added
+yourself drop out instead of becoming invalid `with:` keys), follows aliases back to the
+relation they select, compiles each relation's `where` / `orderBy` / `limit` / `offset`
+into its nested entry, and leaves `<relation>Aggregate` selections out — they are not
+`with:` entries. It returns `undefined` when the selection asks for no relations.
+
+`resolveSelection` additionally accepts `single`, `orderBy`, `limit`, `offset` and `after`,
+and returns the rows already remapped to their GraphQL transport forms.
+
+Both take a `typeNameMapper` option. If the schema was built with one, pass the same
+function here — the translation matches selections against GraphQL type names, so a build
+that renames its types has to say so.
+
+## Identifying generated fields
+
+Every generated field and object type publishes what it is under `extensions.drizzle`, so
+wrappers — `graphql-middleware`, envelop, `graphql-shield`, an audit log, a cache
+invalidator — can ask the schema instead of parsing field names. Names are configurable
+(`prefixes`, `suffixes`, `typeNameMapper`), which makes name parsing ambiguous by
+construction; this is not.
+
+```Typescript
+import { drizzleExtension, identifyRows } from '@vantreeseba/drizzle-graphql'
+
+const field = info.parentType.getFields()[info.fieldName]
+const meta = drizzleExtension(field)
+// {
+//   table: 'Users',        // the Drizzle schema key
+//   kind: 'mutation',      // 'query' | 'mutation' | 'relation' | 'aggregate' | 'type'
+//   operation: 'update',   // 'select' | 'insert' | 'update' | 'updateMany' | 'upsert'
+//                          // | 'delete' | 'aggregate' | 'groupBy' | 'relation'
+//                          // | 'relationAggregate'
+//   single: true,          // one row, or a list
+//   targetArg: 'where',    // 'where' | 'values' | 'updates' — where the rows live
+//   primaryKey: ['id'],    // key columns of `table`, in schema order
+// }
+
+if (meta?.kind === 'mutation') await audit(meta.table, meta.operation, args[meta.targetArg])
+```
+
+`drizzleExtension` returns `undefined` for anything this library did not generate, which is
+the check to make before treating a field as one of ours. Relation fields (and
+`<relation>Aggregate` fields) additionally carry `relation` and `parentTable`, with `table`
+naming the relation's **target** — so `Users.posts` reads as
+`{ table: 'Posts', parentTable: 'Users', relation: 'posts' }`. Object types carry
+`{ table, kind: 'type', primaryKey }`, which is what a stitching layer needs to map a type
+back to its source.
+
+Because the row identity of a mutation lives in a different argument for every operation,
+`identifyRows` reads whichever one applies and hands back primary-key values:
+
+```Typescript
+const target = identifyRows(field, args)
+// { table: 'Users', primaryKey: ['id'], rows: [{ id: 3 }], complete: true }
+
+if (target?.complete) await invalidate(target.table, target.rows)
+```
+
+It understands `values` (one object or a list), `where` (`eq` for one row, `inArray` for
+many, an equality on every column of a composite key), and the per-entry `where` inside a
+batch update's `updates`. Check `complete` before treating `rows` as the affected set: it
+is `false` when the arguments do not pin the rows down — an insert whose key the database
+generates, a filter on something other than the primary key, an unbounded update, or a
+table with no primary key at all.
+
+> [!NOTE]
+> `extensions.drizzle` is stable API. The point of publishing it is that consumers stop
+> parsing names, which only holds if the shape does not move: fields are added to it, never
+> removed or repurposed.
 ## Configuration reference
 
 Every key of the second argument to `buildSchema(db, config?)`. Each links to the section