@web-ts-toolkit/moo 0.42.2 → 0.47.1

package/plugins/index.mjs

@@ -51,6 +51,121 @@ var resolveFilter = (value, document) => {
   }
   return result;
 };
+var isNonEmptyString = (value) => typeof value === "string" && value.trim().length > 0;
+var isEmptyFilterObject = (value) => Object.keys(value).length === 0;
+var EMPTY_FULL_FILTER_MESSAGE = "cascadeDeletePlugin rejects empty foreignFilter by default because {} would match every document in the dependent collection; provide a non-empty filter object. Broad deletes are not implicitly enabled.";
+var DEFAULT_MAX_CONCURRENCY = 8;
+var DEFAULT_BATCH_SIZE = 100;
+var assertPositiveIntOption = (value, name, modelName) => {
+  if (value === void 0) return;
+  if (typeof value !== "number" || !Number.isInteger(value) || value < 1) {
+    throw new Error(
+      `cascadeDeletePlugin for model "${modelName}" requires \`${name}\` to be an integer >= 1 when provided`
+    );
+  }
+};
+var assertPluginOptions = (options) => {
+  if (!isPlainObject2(options)) {
+    throw new Error("cascadeDeletePlugin requires options with a non-empty `model` name");
+  }
+  const { model, localField, foreignField, foreignFilter, extraForeignFilter } = options;
+  if (!isNonEmptyString(model)) {
+    throw new Error("cascadeDeletePlugin requires a non-empty `model` name");
+  }
+  if (localField !== void 0 && !isNonEmptyString(localField)) {
+    throw new Error("cascadeDeletePlugin requires `localField` to be a non-empty string when provided");
+  }
+  assertPositiveIntOption(options.maxConcurrency, "maxConcurrency", model);
+  assertPositiveIntOption(options.batchSize, "batchSize", model);
+  if (foreignField !== void 0 && !isNonEmptyString(foreignField)) {
+    throw new Error("cascadeDeletePlugin requires `foreignField` to be a non-empty string when provided");
+  }
+  if (foreignFilter !== void 0) {
+    if (!isFunction2(foreignFilter) && !isPlainObject2(foreignFilter)) {
+      throw new Error(
+        `cascadeDeletePlugin invalid \`foreignFilter\` for model "${model}": expected a plain filter object or a resolver function`
+      );
+    }
+    if (isPlainObject2(foreignFilter) && isEmptyFilterObject(foreignFilter)) {
+      throw new Error(`cascadeDeletePlugin ${EMPTY_FULL_FILTER_MESSAGE}`);
+    }
+  } else if (!isNonEmptyString(localField) || !isNonEmptyString(foreignField)) {
+    throw new Error(
+      `cascadeDeletePlugin for model "${model}" requires either \`foreignFilter\` or both \`localField\` and \`foreignField\``
+    );
+  }
+  if (extraForeignFilter !== void 0) {
+    if (!isFunction2(extraForeignFilter) && !isPlainObject2(extraForeignFilter)) {
+      throw new Error(
+        `cascadeDeletePlugin invalid \`extraForeignFilter\` for model "${model}": expected a plain filter object or a resolver function`
+      );
+    }
+  }
+};
+var assertFullFilterNotEmpty = (filter, modelName) => {
+  if (isEmptyFilterObject(filter)) {
+    throw new Error(`cascadeDeletePlugin for model "${modelName}" ${EMPTY_FULL_FILTER_MESSAGE}`);
+  }
+};
+var isMissingScalarKey = (value) => {
+  if (value === void 0 || value === null) return true;
+  if (typeof value === "string" && value.trim().length === 0) return true;
+  return false;
+};
+var unwrapKeyValue = (value) => {
+  if (isPlainObject2(value)) {
+    const candidate = value._id;
+    if (candidate !== void 0 && candidate !== null) return candidate;
+  }
+  if (isObject(value)) {
+    try {
+      const candidate = value._id;
+      if (candidate !== void 0 && candidate !== null) return candidate;
+    } catch {
+    }
+  }
+  return value;
+};
+var normalizeKeyList = (localValue) => {
+  if (Array.isArray(localValue)) {
+    const keys = [];
+    for (const entry of localValue) {
+      const unwrapped2 = unwrapKeyValue(entry);
+      if (!isMissingScalarKey(unwrapped2)) keys.push(unwrapped2);
+    }
+    return keys.length > 0 ? keys : null;
+  }
+  const unwrapped = unwrapKeyValue(localValue);
+  if (isMissingScalarKey(unwrapped)) return null;
+  return [unwrapped];
+};
+var isPathDeselected = (owner, path) => {
+  try {
+    const candidate = owner;
+    if (typeof candidate.$isSelected === "function") {
+      const result = candidate.$isSelected(path);
+      if (typeof result === "boolean") return result === false;
+    }
+    if (typeof candidate.isSelected === "function") {
+      const result = candidate.isSelected(path);
+      if (typeof result === "boolean") return result === false;
+    }
+  } catch {
+  }
+  return false;
+};
+var buildRelationshipPredicate = (foreignField, localValue) => {
+  const keys = normalizeKeyList(localValue);
+  if (!keys) return null;
+  if (Array.isArray(localValue)) {
+    return { [foreignField]: { $in: keys } };
+  }
+  return { [foreignField]: keys[0] };
+};
+var combineWithRelationship = (relationship, extra) => {
+  if (!extra || isEmptyFilterObject(extra)) return relationship;
+  return { $and: [relationship, extra] };
+};
 var applyQueryOptions = (query, options) => {
   let builder = query;
   if (options.select) {
@@ -65,8 +180,81 @@ var applyQueryOptions = (query, options) => {
   if (options.lean) {
     builder = builder.lean();
   }
+  if (options.session) {
+    builder = builder.session(options.session);
+  }
   return builder;
 };
+var getOwningConnection = (owner) => {
+  const candidate = owner?.collection?.conn ?? owner?.constructor?.collection?.conn ?? null;
+  if (candidate && typeof candidate.model === "function") {
+    return candidate;
+  }
+  return mongoose2;
+};
+var getBoundSession = (owner) => {
+  try {
+    const session = owner?.$session?.() ?? null;
+    return session ?? null;
+  } catch {
+    return null;
+  }
+};
+var resolveExecutionContext = (owner, targetModelName, explicitSession) => {
+  const session = explicitSession ?? getBoundSession(owner) ?? null;
+  const connection = getOwningConnection(owner);
+  const Target = connection.model(targetModelName);
+  return { connection, Target, session };
+};
+var isInTransaction = (session) => {
+  try {
+    return typeof session?.inTransaction === "function" ? session.inTransaction() : false;
+  } catch {
+    return false;
+  }
+};
+var getSessionClient = (session) => {
+  if (!session) return null;
+  return session.client ?? null;
+};
+var getConnectionClient = (connection) => {
+  try {
+    if (connection === mongoose2) {
+      return mongoose2.connection.getClient?.() ?? null;
+    }
+    return connection.getClient?.() ?? null;
+  } catch {
+    return null;
+  }
+};
+var getTopologyType = (client) => {
+  try {
+    const topology = client?.topology;
+    const type = topology?.description?.type;
+    return typeof type === "string" ? type : null;
+  } catch {
+    return null;
+  }
+};
+var assertTransactionSupported = (context) => {
+  const { connection, session } = context;
+  if (!session) return;
+  const sessionClient = getSessionClient(session);
+  const connectionClient = getConnectionClient(connection);
+  if (sessionClient && connectionClient && sessionClient !== connectionClient) {
+    throw new Error(
+      "cascadeDeletePlugin does not support sessions bound to a different connection/client; pass a session from the owning model connection"
+    );
+  }
+  if (isInTransaction(session)) {
+    const topologyType = getTopologyType(sessionClient);
+    if (topologyType === "Single") {
+      throw new Error(
+        "cascadeDeletePlugin does not support transactions on a standalone MongoDB deployment; use a replica set or sharded cluster, or delete without a transaction"
+      );
+    }
+  }
+};
 var supportsDeleteOne = (value) => isObject(value) && typeof value.deleteOne === "function";
 var supportsRemove = (value) => isObject(value) && typeof value.remove === "function";
 var mergeResults = (previousResults, modelName, currentResults) => {
@@ -79,56 +267,189 @@ var mergeResults = (previousResults, modelName, currentResults) => {
     [modelName]: currentResults
   };
 };
+var resolveDependentFilter = (owner, config) => {
+  const { model, localField, foreignField, foreignFilter, extraForeignFilter } = config;
+  const document = owner.toObject({ virtuals: false });
+  if (foreignFilter !== void 0) {
+    const resolved = resolveFilter(foreignFilter, document);
+    if (resolved === null) return null;
+    assertFullFilterNotEmpty(resolved, model);
+    return resolved;
+  }
+  if (localField && foreignField) {
+    const localValue = owner.get(localField);
+    if (normalizeKeyList(localValue) === null) {
+      if (isPathDeselected(owner, localField)) {
+        throw new Error(
+          `cascadeDeletePlugin for model "${model}" cannot resolve dependents: localField "${localField}" was not selected on the document; load the document with that path projected instead of assuming an empty relation`
+        );
+      }
+      return null;
+    }
+    const relationship = buildRelationshipPredicate(foreignField, localValue);
+    if (!relationship) return null;
+    const extraFilter = resolveFilter(extraForeignFilter, document);
+    return combineWithRelationship(relationship, extraFilter);
+  }
+  return null;
+};
+var resolveTraversalLimits = (options) => ({
+  maxConcurrency: typeof options.maxConcurrency === "number" ? options.maxConcurrency : DEFAULT_MAX_CONCURRENCY,
+  batchSize: typeof options.batchSize === "number" ? options.batchSize : DEFAULT_BATCH_SIZE
+});
+var extractIdList = (rows) => rows.map((row) => {
+  if (isPlainObject2(row)) return row._id;
+  if (isObject(row)) {
+    try {
+      const candidate = row._id;
+      if (candidate !== void 0) return candidate;
+    } catch {
+    }
+  }
+  return row;
+});
+var fetchDependentIdPage = async (Target, filter, session, lastId, batchSize) => {
+  const paged = lastId === void 0 ? filter : { $and: [filter, { _id: { $gt: lastId } }] };
+  let query = Target.find(paged).select("_id").sort({ _id: 1 }).limit(batchSize).lean();
+  if (session) query = query.session(session);
+  const rows = await query;
+  return extractIdList(Array.isArray(rows) ? rows : []);
+};
+var loadHydratedDependent = async (Target, id, session) => {
+  const query = Target.findById(id);
+  const result = session ? await query.session(session) : await query;
+  return result ?? null;
+};
+var runWithConcurrencyLimit = async (items, limit, task) => {
+  if (items.length === 0) return;
+  const workerCount = Math.max(1, Math.min(limit, items.length));
+  let next = 0;
+  let failed = false;
+  let firstError = null;
+  const workers = Array.from({ length: workerCount }, () => {
+    const run = async () => {
+      while (true) {
+        if (failed) return;
+        const index = next;
+        next += 1;
+        if (index >= items.length) return;
+        try {
+          await task(items[index]);
+        } catch (error) {
+          if (!failed) {
+            failed = true;
+            firstError = error;
+          }
+          throw error;
+        }
+      }
+    };
+    return run();
+  });
+  try {
+    await Promise.all(workers);
+  } catch {
+    throw firstError;
+  }
+};
 function cascadeDeletePlugin(schema, options) {
+  assertPluginOptions(options);
   const { model, localField, foreignField, foreignFilter, extraForeignFilter } = options ?? {};
+  const filterConfig = {
+    model,
+    localField,
+    foreignField,
+    foreignFilter,
+    extraForeignFilter
+  };
+  const traversalLimits = resolveTraversalLimits(options ?? {});
   const findDependents = async function(queryOptions) {
-    const Target = mongoose2.model(model);
-    let query = null;
-    const document = this.toObject({ virtuals: false });
-    if (foreignFilter) {
-      query = resolveFilter(foreignFilter, document);
-    } else if (localField && foreignField) {
-      const localValue = this.get(localField);
-      const extraFilter = resolveFilter(extraForeignFilter, document) ?? {};
-      query = {
-        [foreignField]: Array.isArray(localValue) ? { $in: localValue } : localValue,
-        ...extraFilter
-      };
-    }
+    const context = resolveExecutionContext(this, model, queryOptions?.session ?? null);
+    const { Target, session } = context;
+    const query = resolveDependentFilter(this, filterConfig);
     if (!query || !isPlainObject2(query)) {
       return [];
     }
-    return await applyQueryOptions(Target.find(query), queryOptions);
+    const mergedOptions = session ? { ...queryOptions, session } : queryOptions;
+    return await applyQueryOptions(Target.find(query), mergedOptions);
   };
   const findOrphans = async function(queryOptions) {
     if (!localField || !foreignField) return null;
-    const Target = mongoose2.model(model);
+    const context = resolveExecutionContext(this, model, queryOptions?.session ?? null);
+    const { Target, session } = context;
     const schemaValue = Target.schema.obj[foreignField];
     if (!schemaValue) return null;
     const isMyRef = isReference(schemaValue, this.modelName);
     if (!isMyRef) return null;
-    const ids = await this.distinct("_id");
-    const extraFilter = resolveFilter(extraForeignFilter) ?? {};
-    const query = {
-      [foreignField]: { $not: { $in: ids } },
-      ...extraFilter
+    const ids = session != null ? await this.distinct("_id", {}, { session }) : await this.distinct("_id");
+    const extraFilter = resolveFilter(extraForeignFilter);
+    const relationship = {
+      [foreignField]: { $not: { $in: ids } }
     };
-    return await applyQueryOptions(Target.find(query), queryOptions);
+    const query = combineWithRelationship(
+      relationship,
+      extraFilter
+    );
+    const mergedOptions = session ? { ...queryOptions, session } : queryOptions;
+    return await applyQueryOptions(Target.find(query), mergedOptions);
   };
-  const deleteDependents = async function() {
-    const documents = await findDependents.call(this, { select: "_id" });
-    await Promise.all(
-      documents.map((document) => {
-        if (supportsDeleteOne(document)) {
-          return document.deleteOne();
-        }
-        if (supportsRemove(document)) {
-          return document.remove();
+  const deleteDependents = async function(operationOptions) {
+    const context = resolveExecutionContext(this, model, operationOptions?.session ?? null);
+    assertTransactionSupported(context);
+    const { Target, session } = context;
+    const filter = resolveDependentFilter(this, filterConfig);
+    if (!filter || !isPlainObject2(filter)) {
+      return;
+    }
+    const deleteSingle = async (document) => {
+      if (session != null && typeof document.$session === "function") {
+        try {
+          await document.$session?.(session);
+        } catch {
         }
-        return Promise.resolve();
-      })
-    );
+      }
+      if (supportsDeleteOne(document)) {
+        return session != null ? document.deleteOne({ session }) : document.deleteOne();
+      }
+      if (supportsRemove(document)) {
+        return session != null ? document.remove({ session }) : document.remove();
+      }
+      return Promise.resolve();
+    };
+    const deleteById = async (id) => {
+      const hydrated = await loadHydratedDependent(Target, id, session);
+      if (!hydrated) return;
+      await deleteSingle(hydrated);
+    };
+    const effectiveConcurrency = session != null && isInTransaction(session) ? 1 : traversalLimits.maxConcurrency;
+    const seen = /* @__PURE__ */ new Set();
+    let lastId;
+    let firstPage = true;
+    for (; ; ) {
+      const ids = await fetchDependentIdPage(
+        Target,
+        filter,
+        session,
+        firstPage ? void 0 : lastId,
+        traversalLimits.batchSize
+      );
+      firstPage = false;
+      if (ids.length === 0) return;
+      const fresh = ids.filter((id) => {
+        const key = typeof id === "object" && id !== null ? String(id) : `${typeof id}:${String(id)}`;
+        if (seen.has(key)) return false;
+        seen.add(key);
+        return true;
+      });
+      await runWithConcurrencyLimit(fresh, effectiveConcurrency, deleteById);
+      lastId = ids[ids.length - 1];
+      if (ids.length < traversalLimits.batchSize) return;
+    }
   };
+  schema.pre("deleteOne", { document: true, query: false }, async function preDeleteOne(...args) {
+    const explicitSession = args[1]?.session ?? args[0]?.session ?? null;
+    assertTransactionSupported(resolveExecutionContext(this, model, explicitSession));
+  });
   schema.post("deleteOne", { document: true, query: false }, async function postDeleteOne() {
     await deleteDependents.call(this);
   });

package/plugins/keycloak-user-sync.d.mts

@@ -25,10 +25,23 @@ interface KeycloakUserSyncErrorContext {
 interface KeycloakUserSyncSensitiveErrorContext extends KeycloakUserSyncErrorContext {
     document: unknown;
 }
+/**
+ * Allowlisted logger error summary. The logger boundary never receives the
+ * original error, its message/stack/cause, transport request/response data,
+ * or arbitrary enumerable properties — only a sanitized name plus optional
+ * machine codes. `onError` still receives the original error for private
+ * processing.
+ */
+interface KeycloakUserSyncLoggedError {
+    readonly name: string;
+    readonly code?: string;
+    readonly status?: number;
+}
+interface KeycloakUserSyncLogContext extends KeycloakUserSyncErrorContext {
+    readonly error: KeycloakUserSyncLoggedError;
+}
 interface KeycloakUserSyncLogger {
-    error(message: string, context: KeycloakUserSyncErrorContext & {
-        error: unknown;
-    }): void | Promise<void>;
+    error(message: string, context: KeycloakUserSyncLogContext): void | Promise<void>;
 }
 interface KeycloakUserSyncDocument {
     get(path: string): unknown;
@@ -54,6 +67,21 @@ interface KeycloakUserSyncPluginOptions {
     mapPassword?: (document: KeycloakUserSyncDocument) => string | null | undefined;
     /** Mongoose paths that should trigger attribute syncing when mapAttributes reads dynamic fields. */
     attributePaths?: readonly string[];
+    /**
+     * Mongoose paths that should trigger role syncing when mapRoles reads
+     * fields beyond the configured roles path (e.g. a tier or plan field).
+     * Honored only while `syncFields.roles` is enabled. The configured roles
+     * path always triggers; these are additional explicit dependencies.
+     */
+    rolePaths?: readonly string[];
+    /**
+     * Mongoose paths that should trigger password syncing when mapPassword
+     * reads fields beyond the configured password path (e.g. a virtual
+     * backing field or pending-password input). Honored only while
+     * `syncFields.password` is enabled. The mapper itself is still evaluated
+     * only for creation or an actual password-sync intent.
+     */
+    passwordPaths?: readonly string[];
     /** Attribute keys owned by this plugin. Only managed keys are removed when missing from the mapper result. */
     managedAttributes?: readonly string[];
     /** Role names this plugin owns. Role removal is limited to this set; without it, role sync is additive-only. */
@@ -87,4 +115,4 @@ interface KeycloakUserSyncPluginOptions {
  */
 declare function keycloakUserSyncPlugin(schema: Schema, rawOptions: KeycloakUserSyncPluginOptions): void;
 
-export { type KeycloakUserIdentityField, type KeycloakUserSyncDocument, type KeycloakUserSyncErrorContext, type KeycloakUserSyncField, type KeycloakUserSyncLogger, type KeycloakUserSyncPaths, type KeycloakUserSyncPluginOptions, type KeycloakUserSyncSensitiveErrorContext, type ManagedKeycloakClientSecret, keycloakUserSyncPlugin };
+export { type KeycloakUserIdentityField, type KeycloakUserSyncDocument, type KeycloakUserSyncErrorContext, type KeycloakUserSyncField, type KeycloakUserSyncLogContext, type KeycloakUserSyncLoggedError, type KeycloakUserSyncLogger, type KeycloakUserSyncPaths, type KeycloakUserSyncPluginOptions, type KeycloakUserSyncSensitiveErrorContext, type ManagedKeycloakClientSecret, keycloakUserSyncPlugin };

package/plugins/keycloak-user-sync.d.ts

@@ -25,10 +25,23 @@ interface KeycloakUserSyncErrorContext {
 interface KeycloakUserSyncSensitiveErrorContext extends KeycloakUserSyncErrorContext {
     document: unknown;
 }
+/**
+ * Allowlisted logger error summary. The logger boundary never receives the
+ * original error, its message/stack/cause, transport request/response data,
+ * or arbitrary enumerable properties — only a sanitized name plus optional
+ * machine codes. `onError` still receives the original error for private
+ * processing.
+ */
+interface KeycloakUserSyncLoggedError {
+    readonly name: string;
+    readonly code?: string;
+    readonly status?: number;
+}
+interface KeycloakUserSyncLogContext extends KeycloakUserSyncErrorContext {
+    readonly error: KeycloakUserSyncLoggedError;
+}
 interface KeycloakUserSyncLogger {
-    error(message: string, context: KeycloakUserSyncErrorContext & {
-        error: unknown;
-    }): void | Promise<void>;
+    error(message: string, context: KeycloakUserSyncLogContext): void | Promise<void>;
 }
 interface KeycloakUserSyncDocument {
     get(path: string): unknown;
@@ -54,6 +67,21 @@ interface KeycloakUserSyncPluginOptions {
     mapPassword?: (document: KeycloakUserSyncDocument) => string | null | undefined;
     /** Mongoose paths that should trigger attribute syncing when mapAttributes reads dynamic fields. */
     attributePaths?: readonly string[];
+    /**
+     * Mongoose paths that should trigger role syncing when mapRoles reads
+     * fields beyond the configured roles path (e.g. a tier or plan field).
+     * Honored only while `syncFields.roles` is enabled. The configured roles
+     * path always triggers; these are additional explicit dependencies.
+     */
+    rolePaths?: readonly string[];
+    /**
+     * Mongoose paths that should trigger password syncing when mapPassword
+     * reads fields beyond the configured password path (e.g. a virtual
+     * backing field or pending-password input). Honored only while
+     * `syncFields.password` is enabled. The mapper itself is still evaluated
+     * only for creation or an actual password-sync intent.
+     */
+    passwordPaths?: readonly string[];
     /** Attribute keys owned by this plugin. Only managed keys are removed when missing from the mapper result. */
     managedAttributes?: readonly string[];
     /** Role names this plugin owns. Role removal is limited to this set; without it, role sync is additive-only. */
@@ -87,4 +115,4 @@ interface KeycloakUserSyncPluginOptions {
  */
 declare function keycloakUserSyncPlugin(schema: Schema, rawOptions: KeycloakUserSyncPluginOptions): void;
 
-export { type KeycloakUserIdentityField, type KeycloakUserSyncDocument, type KeycloakUserSyncErrorContext, type KeycloakUserSyncField, type KeycloakUserSyncLogger, type KeycloakUserSyncPaths, type KeycloakUserSyncPluginOptions, type KeycloakUserSyncSensitiveErrorContext, type ManagedKeycloakClientSecret, keycloakUserSyncPlugin };
+export { type KeycloakUserIdentityField, type KeycloakUserSyncDocument, type KeycloakUserSyncErrorContext, type KeycloakUserSyncField, type KeycloakUserSyncLogContext, type KeycloakUserSyncLoggedError, type KeycloakUserSyncLogger, type KeycloakUserSyncPaths, type KeycloakUserSyncPluginOptions, type KeycloakUserSyncSensitiveErrorContext, type ManagedKeycloakClientSecret, keycloakUserSyncPlugin };