@wordrhyme/auto-crud-server 0.6.1 → 0.6.2

package/dist/index.cjs

@@ -493,7 +493,7 @@ function createCrudRouter(config) {
 		const conditions = [];
 		const scopeCondition = resolved.getScope(ctx, table, operation);
 		if (scopeCondition) conditions.push(scopeCondition);
-		if (softDelete && (operation === "list" || operation === "get")) {
+		if (softDelete) {
 			const col = getSoftDeleteColumn();
 			if (col) conditions.push((0, drizzle_orm.isNull)(col));
 		}
@@ -507,15 +507,24 @@ function createCrudRouter(config) {
 			if (operation === "upsert") {
 				const canCreate = await resolved.guard(ctx, "create");
 				const canUpdate = await resolved.guard(ctx, "update");
-				if (!canCreate || !canUpdate) throw new Error("Forbidden: upsert requires both create and update permissions");
+				if (!canCreate || !canUpdate) throw new __trpc_server.TRPCError({
+					code: "FORBIDDEN",
+					message: "Forbidden: upsert requires both create and update permissions"
+				});
 				return;
 			}
-			if (!await resolved.guard(ctx, operation)) throw new Error(`Forbidden: ${operation} not allowed`);
+			if (!await resolved.guard(ctx, operation)) throw new __trpc_server.TRPCError({
+				code: "FORBIDDEN",
+				message: `Forbidden: ${operation} not allowed`
+			});
 		}
 	};
 	const withAuthorize = async (ctx, resource, operation) => {
 		if (!resource) return;
-		if (!await resolved.checkAuthorize(ctx, resource, operation)) throw new Error(`Forbidden: Cannot ${operation} this resource`);
+		if (!await resolved.checkAuthorize(ctx, resource, operation)) throw new __trpc_server.TRPCError({
+			code: "FORBIDDEN",
+			message: `Forbidden: Cannot ${operation} this resource`
+		});
 	};
 	const procedures = {
 		list: resolved.procedureFactory("list").input(listInputSchema).query(async ({ ctx, input }) => {
@@ -598,7 +607,10 @@ function createCrudRouter(config) {
 			const where = buildWhere(ctx, "update", (0, drizzle_orm.eq)(getIdColumn(), input.id));
 			const [existing] = await ctx.db.select().from(table).where(where);
 			await withAuthorize(ctx, existing, "update");
-			if (!existing) throw new Error("Resource not found or access denied");
+			if (!existing) throw new __trpc_server.TRPCError({
+				code: "NOT_FOUND",
+				message: "Resource not found or access denied"
+			});
 			const doUpdate = async (updateData) => {
 				const injectData = resolved.getInject(ctx, "update");
 				const data = {
@@ -622,7 +634,10 @@ function createCrudRouter(config) {
 			const where = buildWhere(ctx, "delete", (0, drizzle_orm.eq)(getIdColumn(), input));
 			const [existing] = await ctx.db.select().from(table).where(where);
 			await withAuthorize(ctx, existing, "delete");
-			if (!existing) throw new Error("Resource not found or access denied");
+			if (!existing) throw new __trpc_server.TRPCError({
+				code: "NOT_FOUND",
+				message: "Resource not found or access denied"
+			});
 			const doDelete = async () => {
 				let deleted;
 				if (softDelete) [deleted] = await ctx.db.update(table).set({ [softDelete.column]: softDelete.getValue() }).where(where).returning();
@@ -641,8 +656,8 @@ function createCrudRouter(config) {
 			await withGuard(ctx, "deleteMany");
 			const where = buildWhere(ctx, "deleteMany", (0, drizzle_orm.inArray)(getIdColumn(), input));
 			const doDeleteMany = async () => {
-				if (softDelete) return { deleted: (await ctx.db.update(table).set({ [softDelete.column]: softDelete.getValue() }).where(where).returning()).length };
-				else return { deleted: (await ctx.db.delete(table).where(where).returning()).length };
+				if (softDelete) return { deleted: (await ctx.db.update(table).set({ [softDelete.column]: softDelete.getValue() }).where(where).returning({ id: getIdColumn() })).length };
+				else return { deleted: (await ctx.db.delete(table).where(where).returning({ id: getIdColumn() })).length };
 			};
 			if (m.deleteMany) return m.deleteMany({
 				ctx,
@@ -663,7 +678,7 @@ function createCrudRouter(config) {
 					...updateData,
 					...injectData
 				};
-				return { updated: (await ctx.db.update(table).set(data).where(where).returning()).length };
+				return { updated: (await ctx.db.update(table).set(data).where(where).returning({ id: getIdColumn() })).length };
 			};
 			if (m.updateMany) return m.updateMany({
 				ctx,
@@ -676,21 +691,27 @@ function createCrudRouter(config) {
 		upsert: resolved.procedureFactory("upsert").input(insertSchema).mutation(async ({ ctx, input }) => {
 			await withGuard(ctx, "upsert");
 			const doUpsert = async (inputData) => {
-				const injectData = resolved.getInject(ctx, "create");
-				const data = {
-					...inputData,
-					...injectData
-				};
 				const inputId = inputData[idField];
 				let isNew = true;
+				let existing = null;
 				if (inputId) {
 					const where = buildWhere(ctx, "get", (0, drizzle_orm.eq)(getIdColumn(), inputId));
-					const [existing] = await ctx.db.select().from(table).where(where);
+					const [found] = await ctx.db.select().from(table).where(where);
+					existing = found;
 					isNew = !existing;
+					if (!isNew && existing) await withAuthorize(ctx, existing, "update");
 				}
+				const injectData = resolved.getInject(ctx, isNew ? "create" : "update");
+				const data = {
+					...inputData,
+					...injectData
+				};
 				const [result] = await ctx.db.insert(table).values(data).onConflictDoUpdate({
 					target: getIdColumn(),
-					set: data
+					set: {
+						...inputData,
+						...resolved.getInject(ctx, "update")
+					}
 				}).returning();
 				return {
 					data: result,

package/dist/index.js

@@ -1,6 +1,6 @@
 import { z } from "zod";
 import { and, asc, desc, eq, gt, gte, ilike, inArray, isNull, lt, lte, ne, not, notIlike, notInArray, or, sql } from "drizzle-orm";
-import { initTRPC } from "@trpc/server";
+import { TRPCError, initTRPC } from "@trpc/server";
 import superjson from "superjson";
 import { addDays, endOfDay, startOfDay } from "date-fns";
 
@@ -465,7 +465,7 @@ function createCrudRouter(config) {
 		const conditions = [];
 		const scopeCondition = resolved.getScope(ctx, table, operation);
 		if (scopeCondition) conditions.push(scopeCondition);
-		if (softDelete && (operation === "list" || operation === "get")) {
+		if (softDelete) {
 			const col = getSoftDeleteColumn();
 			if (col) conditions.push(isNull(col));
 		}
@@ -479,15 +479,24 @@ function createCrudRouter(config) {
 			if (operation === "upsert") {
 				const canCreate = await resolved.guard(ctx, "create");
 				const canUpdate = await resolved.guard(ctx, "update");
-				if (!canCreate || !canUpdate) throw new Error("Forbidden: upsert requires both create and update permissions");
+				if (!canCreate || !canUpdate) throw new TRPCError({
+					code: "FORBIDDEN",
+					message: "Forbidden: upsert requires both create and update permissions"
+				});
 				return;
 			}
-			if (!await resolved.guard(ctx, operation)) throw new Error(`Forbidden: ${operation} not allowed`);
+			if (!await resolved.guard(ctx, operation)) throw new TRPCError({
+				code: "FORBIDDEN",
+				message: `Forbidden: ${operation} not allowed`
+			});
 		}
 	};
 	const withAuthorize = async (ctx, resource, operation) => {
 		if (!resource) return;
-		if (!await resolved.checkAuthorize(ctx, resource, operation)) throw new Error(`Forbidden: Cannot ${operation} this resource`);
+		if (!await resolved.checkAuthorize(ctx, resource, operation)) throw new TRPCError({
+			code: "FORBIDDEN",
+			message: `Forbidden: Cannot ${operation} this resource`
+		});
 	};
 	const procedures = {
 		list: resolved.procedureFactory("list").input(listInputSchema).query(async ({ ctx, input }) => {
@@ -570,7 +579,10 @@ function createCrudRouter(config) {
 			const where = buildWhere(ctx, "update", eq(getIdColumn(), input.id));
 			const [existing] = await ctx.db.select().from(table).where(where);
 			await withAuthorize(ctx, existing, "update");
-			if (!existing) throw new Error("Resource not found or access denied");
+			if (!existing) throw new TRPCError({
+				code: "NOT_FOUND",
+				message: "Resource not found or access denied"
+			});
 			const doUpdate = async (updateData) => {
 				const injectData = resolved.getInject(ctx, "update");
 				const data = {
@@ -594,7 +606,10 @@ function createCrudRouter(config) {
 			const where = buildWhere(ctx, "delete", eq(getIdColumn(), input));
 			const [existing] = await ctx.db.select().from(table).where(where);
 			await withAuthorize(ctx, existing, "delete");
-			if (!existing) throw new Error("Resource not found or access denied");
+			if (!existing) throw new TRPCError({
+				code: "NOT_FOUND",
+				message: "Resource not found or access denied"
+			});
 			const doDelete = async () => {
 				let deleted;
 				if (softDelete) [deleted] = await ctx.db.update(table).set({ [softDelete.column]: softDelete.getValue() }).where(where).returning();
@@ -613,8 +628,8 @@ function createCrudRouter(config) {
 			await withGuard(ctx, "deleteMany");
 			const where = buildWhere(ctx, "deleteMany", inArray(getIdColumn(), input));
 			const doDeleteMany = async () => {
-				if (softDelete) return { deleted: (await ctx.db.update(table).set({ [softDelete.column]: softDelete.getValue() }).where(where).returning()).length };
-				else return { deleted: (await ctx.db.delete(table).where(where).returning()).length };
+				if (softDelete) return { deleted: (await ctx.db.update(table).set({ [softDelete.column]: softDelete.getValue() }).where(where).returning({ id: getIdColumn() })).length };
+				else return { deleted: (await ctx.db.delete(table).where(where).returning({ id: getIdColumn() })).length };
 			};
 			if (m.deleteMany) return m.deleteMany({
 				ctx,
@@ -635,7 +650,7 @@ function createCrudRouter(config) {
 					...updateData,
 					...injectData
 				};
-				return { updated: (await ctx.db.update(table).set(data).where(where).returning()).length };
+				return { updated: (await ctx.db.update(table).set(data).where(where).returning({ id: getIdColumn() })).length };
 			};
 			if (m.updateMany) return m.updateMany({
 				ctx,
@@ -648,21 +663,27 @@ function createCrudRouter(config) {
 		upsert: resolved.procedureFactory("upsert").input(insertSchema).mutation(async ({ ctx, input }) => {
 			await withGuard(ctx, "upsert");
 			const doUpsert = async (inputData) => {
-				const injectData = resolved.getInject(ctx, "create");
-				const data = {
-					...inputData,
-					...injectData
-				};
 				const inputId = inputData[idField];
 				let isNew = true;
+				let existing = null;
 				if (inputId) {
 					const where = buildWhere(ctx, "get", eq(getIdColumn(), inputId));
-					const [existing] = await ctx.db.select().from(table).where(where);
+					const [found] = await ctx.db.select().from(table).where(where);
+					existing = found;
 					isNew = !existing;
+					if (!isNew && existing) await withAuthorize(ctx, existing, "update");
 				}
+				const injectData = resolved.getInject(ctx, isNew ? "create" : "update");
+				const data = {
+					...inputData,
+					...injectData
+				};
 				const [result] = await ctx.db.insert(table).values(data).onConflictDoUpdate({
 					target: getIdColumn(),
-					set: data
+					set: {
+						...inputData,
+						...resolved.getInject(ctx, "update")
+					}
 				}).returning();
 				return {
 					data: result,

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@wordrhyme/auto-crud-server",
   "type": "module",
-  "version": "0.6.1",
+  "version": "0.6.2",
   "description": "tRPC server utilities for auto-crud - automatic CRUD routers for Drizzle ORM",
   "author": "wordrhyme",
   "license": "MIT",
@@ -45,12 +45,13 @@
     "superjson": "^2.2.6",
     "tsdown": "^0.15.12",
     "typescript": "^5.9.3",
+    "vitest": "^4.0.18",
     "zod": "^4.1.13",
-    "@internal/eslint-config": "0.3.0",
     "@internal/prettier-config": "0.0.1",
     "@internal/tsconfig": "0.1.0",
+    "@internal/tsdown-config": "0.1.0",
     "@internal/vitest-config": "0.1.0",
-    "@internal/tsdown-config": "0.1.0"
+    "@internal/eslint-config": "0.3.0"
   },
   "prettier": "@internal/prettier-config",
   "scripts": {
@@ -60,6 +61,7 @@
     "build:watch": "tsdown --watch",
     "test": "vitest --run --passWithNoTests",
     "test:watch": "vitest --watch",
+    "test:coverage": "vitest --run --coverage",
     "typecheck": "tsc --noEmit",
     "lint": "eslint",
     "format": "prettier --check . --ignore-path ../../.gitignore"