@wordrhyme/auto-crud-server 0.6.1 → 0.7.0

package/dist/index.cjs

@@ -417,38 +417,53 @@ function resolveSoftDelete(option) {
 		getValue: config.value ?? (() => /* @__PURE__ */ new Date())
 	};
 }
-function resolveConfig(config) {
-	const mode = config.mode || "declarative";
-	if (mode === "factory") {
-		const factoryConfig = config;
-		return {
-			procedureFactory: factoryConfig.procedureFactory,
-			guard: void 0,
-			getScope: () => void 0,
-			getInject: (ctx, op) => factoryConfig.inject?.(ctx, op) ?? {},
-			checkAuthorize: async () => true
-		};
+/**
+* 判断 procedure 配置的类型
+*/
+function isProcedureMap(config) {
+	if (!config) return false;
+	if (typeof config === "function") return false;
+	if (typeof config === "object" && config !== null) {
+		const keys = Object.keys(config);
+		const validKeys = [
+			"list",
+			"get",
+			"create",
+			"update",
+			"delete",
+			"deleteMany",
+			"updateMany",
+			"upsert",
+			"default"
+		];
+		return keys.some((k) => validKeys.includes(k));
 	}
-	if (mode === "procedures") {
-		const proceduresConfig = config;
-		const defaultProc = proceduresConfig.defaultProcedure ?? publicProcedure;
-		return {
-			procedureFactory: (op) => proceduresConfig.procedures[op] ?? defaultProc,
-			guard: void 0,
-			getScope: () => void 0,
-			getInject: (ctx, op) => proceduresConfig.inject?.(ctx, op) ?? {},
-			checkAuthorize: async () => true
-		};
+	return false;
+}
+function isProcedureFactory(config) {
+	return typeof config === "function";
+}
+/**
+* 解析 procedure 配置为工厂函数
+*/
+function resolveProcedureFactory(config) {
+	if (!config) return () => publicProcedure;
+	if (isProcedureFactory(config)) return config;
+	if (isProcedureMap(config)) {
+		const map = config;
+		const defaultProc = map.default ?? publicProcedure;
+		return (op) => map[op] ?? defaultProc;
 	}
-	const declarativeConfig = config;
-	const baseProcedure = declarativeConfig.procedure ?? publicProcedure;
+	return () => config;
+}
+function resolveConfig(config) {
 	return {
-		procedureFactory: () => baseProcedure,
-		guard: declarativeConfig.guard,
-		getScope: (ctx, tbl, op) => declarativeConfig.scope?.(ctx, tbl, op),
-		getInject: (ctx, op) => declarativeConfig.inject?.(ctx, op) ?? {},
+		procedureFactory: resolveProcedureFactory(config.procedure),
+		guard: config.guard,
+		getScope: (ctx, tbl, op) => config.scope?.(ctx, tbl, op),
+		getInject: (ctx, op) => config.inject?.(ctx, op) ?? {},
 		checkAuthorize: async (ctx, resource, op) => {
-			if (declarativeConfig.authorize) return declarativeConfig.authorize(ctx, resource, op);
+			if (config.authorize) return config.authorize(ctx, resource, op);
 			return true;
 		}
 	};
@@ -493,7 +508,7 @@ function createCrudRouter(config) {
 		const conditions = [];
 		const scopeCondition = resolved.getScope(ctx, table, operation);
 		if (scopeCondition) conditions.push(scopeCondition);
-		if (softDelete && (operation === "list" || operation === "get")) {
+		if (softDelete) {
 			const col = getSoftDeleteColumn();
 			if (col) conditions.push((0, drizzle_orm.isNull)(col));
 		}
@@ -507,15 +522,24 @@ function createCrudRouter(config) {
 			if (operation === "upsert") {
 				const canCreate = await resolved.guard(ctx, "create");
 				const canUpdate = await resolved.guard(ctx, "update");
-				if (!canCreate || !canUpdate) throw new Error("Forbidden: upsert requires both create and update permissions");
+				if (!canCreate || !canUpdate) throw new __trpc_server.TRPCError({
+					code: "FORBIDDEN",
+					message: "Forbidden: upsert requires both create and update permissions"
+				});
 				return;
 			}
-			if (!await resolved.guard(ctx, operation)) throw new Error(`Forbidden: ${operation} not allowed`);
+			if (!await resolved.guard(ctx, operation)) throw new __trpc_server.TRPCError({
+				code: "FORBIDDEN",
+				message: `Forbidden: ${operation} not allowed`
+			});
 		}
 	};
 	const withAuthorize = async (ctx, resource, operation) => {
 		if (!resource) return;
-		if (!await resolved.checkAuthorize(ctx, resource, operation)) throw new Error(`Forbidden: Cannot ${operation} this resource`);
+		if (!await resolved.checkAuthorize(ctx, resource, operation)) throw new __trpc_server.TRPCError({
+			code: "FORBIDDEN",
+			message: `Forbidden: Cannot ${operation} this resource`
+		});
 	};
 	const procedures = {
 		list: resolved.procedureFactory("list").input(listInputSchema).query(async ({ ctx, input }) => {
@@ -598,7 +622,10 @@ function createCrudRouter(config) {
 			const where = buildWhere(ctx, "update", (0, drizzle_orm.eq)(getIdColumn(), input.id));
 			const [existing] = await ctx.db.select().from(table).where(where);
 			await withAuthorize(ctx, existing, "update");
-			if (!existing) throw new Error("Resource not found or access denied");
+			if (!existing) throw new __trpc_server.TRPCError({
+				code: "NOT_FOUND",
+				message: "Resource not found or access denied"
+			});
 			const doUpdate = async (updateData) => {
 				const injectData = resolved.getInject(ctx, "update");
 				const data = {
@@ -622,7 +649,10 @@ function createCrudRouter(config) {
 			const where = buildWhere(ctx, "delete", (0, drizzle_orm.eq)(getIdColumn(), input));
 			const [existing] = await ctx.db.select().from(table).where(where);
 			await withAuthorize(ctx, existing, "delete");
-			if (!existing) throw new Error("Resource not found or access denied");
+			if (!existing) throw new __trpc_server.TRPCError({
+				code: "NOT_FOUND",
+				message: "Resource not found or access denied"
+			});
 			const doDelete = async () => {
 				let deleted;
 				if (softDelete) [deleted] = await ctx.db.update(table).set({ [softDelete.column]: softDelete.getValue() }).where(where).returning();
@@ -641,8 +671,8 @@ function createCrudRouter(config) {
 			await withGuard(ctx, "deleteMany");
 			const where = buildWhere(ctx, "deleteMany", (0, drizzle_orm.inArray)(getIdColumn(), input));
 			const doDeleteMany = async () => {
-				if (softDelete) return { deleted: (await ctx.db.update(table).set({ [softDelete.column]: softDelete.getValue() }).where(where).returning()).length };
-				else return { deleted: (await ctx.db.delete(table).where(where).returning()).length };
+				if (softDelete) return { deleted: (await ctx.db.update(table).set({ [softDelete.column]: softDelete.getValue() }).where(where).returning({ id: getIdColumn() })).length };
+				else return { deleted: (await ctx.db.delete(table).where(where).returning({ id: getIdColumn() })).length };
 			};
 			if (m.deleteMany) return m.deleteMany({
 				ctx,
@@ -663,7 +693,7 @@ function createCrudRouter(config) {
 					...updateData,
 					...injectData
 				};
-				return { updated: (await ctx.db.update(table).set(data).where(where).returning()).length };
+				return { updated: (await ctx.db.update(table).set(data).where(where).returning({ id: getIdColumn() })).length };
 			};
 			if (m.updateMany) return m.updateMany({
 				ctx,
@@ -676,21 +706,27 @@ function createCrudRouter(config) {
 		upsert: resolved.procedureFactory("upsert").input(insertSchema).mutation(async ({ ctx, input }) => {
 			await withGuard(ctx, "upsert");
 			const doUpsert = async (inputData) => {
-				const injectData = resolved.getInject(ctx, "create");
-				const data = {
-					...inputData,
-					...injectData
-				};
 				const inputId = inputData[idField];
 				let isNew = true;
+				let existing = null;
 				if (inputId) {
 					const where = buildWhere(ctx, "get", (0, drizzle_orm.eq)(getIdColumn(), inputId));
-					const [existing] = await ctx.db.select().from(table).where(where);
+					const [found] = await ctx.db.select().from(table).where(where);
+					existing = found;
 					isNew = !existing;
+					if (!isNew && existing) await withAuthorize(ctx, existing, "update");
 				}
+				const injectData = resolved.getInject(ctx, isNew ? "create" : "update");
+				const data = {
+					...inputData,
+					...injectData
+				};
 				const [result] = await ctx.db.insert(table).values(data).onConflictDoUpdate({
 					target: getIdColumn(),
-					set: data
+					set: {
+						...inputData,
+						...resolved.getInject(ctx, "update")
+					}
 				}).returning();
 				return {
 					data: result,

package/dist/index.d.cts

@@ -191,15 +191,137 @@ interface CrudMiddleware<TContext = unknown, TSelect = unknown, TInsert = unknow
     isNew: boolean;
   }>;
 }
-interface CrudRouterConfigBase<TContext = unknown, TSelect = unknown, TInsert = unknown, TUpdate = unknown> {
+/**
+ * Procedure 映射对象
+ * 按操作指定不同的 procedure，支持 default 回退
+ */
+interface ProcedureMap {
+  list?: AnyProcedure;
+  get?: AnyProcedure;
+  create?: AnyProcedure;
+  update?: AnyProcedure;
+  delete?: AnyProcedure;
+  deleteMany?: AnyProcedure;
+  updateMany?: AnyProcedure;
+  upsert?: AnyProcedure;
+  /** 未指定操作时的默认 procedure */
+  default?: AnyProcedure;
+}
+/**
+ * Procedure 工厂函数
+ * 根据操作类型动态返回 procedure
+ */
+type ProcedureFactory = (operation: CrudOperation) => AnyProcedure;
+/**
+ * 统一的 Procedure 配置
+ * 支持三种形式：
+ * 1. 单一 procedure - 所有操作共用
+ * 2. 对象映射 - 按操作指定
+ * 3. 工厂函数 - 动态生成
+ *
+ * @example
+ * // 形式 1：单一 procedure
+ * procedure: protectedProcedure
+ *
+ * // 形式 2：对象映射（推荐常用场景）
+ * procedure: {
+ *   list: publicProcedure,
+ *   get: publicProcedure,
+ *   create: editorProcedure,
+ *   delete: adminProcedure,
+ *   default: protectedProcedure,
+ * }
+ *
+ * // 形式 3：工厂函数（适合复杂逻辑）
+ * procedure: (op) => {
+ *   if (['list', 'get'].includes(op)) return publicProcedure;
+ *   return protectedProcedure.meta({ permission: { action: op, subject: 'Task' } });
+ * }
+ */
+type ProcedureConfig = AnyProcedure | ProcedureMap | ProcedureFactory;
+/**
+ * CRUD Router 配置
+ *
+ * v2.0 统一 API 设计：
+ * - 所有配置项可自由组合，无互斥模式
+ * - procedure 支持多种形式（单一/映射/工厂）
+ * - guard/scope/authorize 可与任意 procedure 形式组合
+ *
+ * @example
+ * // 简单场景：公开读，保护写
+ * createCrudRouter({
+ *   table: posts,
+ *   insertSchema,
+ *   updateSchema,
+ *   procedure: {
+ *     list: publicProcedure,
+ *     get: publicProcedure,
+ *     default: protectedProcedure,
+ *   },
+ * })
+ *
+ * // 复杂场景：自定义 procedure + 行级安全
+ * createCrudRouter({
+ *   table: posts,
+ *   insertSchema,
+ *   updateSchema,
+ *   procedure: adminProcedure,
+ *   scope: (ctx, table) => eq(table.tenantId, ctx.user.tenantId),
+ *   authorize: (ctx, resource) => resource.ownerId === ctx.user.id,
+ * })
+ */
+interface CrudRouterConfig<TContext = unknown, TSelect = unknown, TInsert = unknown, TUpdate = unknown> {
   /** Drizzle 表定义 */
   table: PgTable;
-  /** 查询返回 Schema */
-  selectSchema?: z.ZodType<TSelect>;
   /** 创建输入 Schema */
   insertSchema: z.ZodType<TInsert>;
   /** 更新输入 Schema */
   updateSchema: z.ZodType<TUpdate>;
+  /**
+   * Procedure 配置（统一字段）
+   *
+   * 支持三种形式：
+   * 1. 单一 procedure - 所有操作共用
+   * 2. 对象映射 - 按操作指定（推荐）
+   * 3. 工厂函数 - 动态生成
+   *
+   * 默认: publicProcedure
+   */
+  procedure?: ProcedureConfig;
+  /**
+   * 操作级守卫（RBAC）
+   * 在 scope 之前执行，快速拒绝无权限请求
+   *
+   * @example
+   * guard: (ctx, op) => op === 'delete' ? ctx.user.role === 'admin' : true
+   */
+  guard?: (ctx: TContext, operation: CrudOperation) => boolean | Promise<boolean>;
+  /**
+   * 行级过滤（RLS）
+   * 返回 SQL 条件，自动注入到 WHERE 子句
+   *
+   * @example
+   * scope: (ctx, table) => eq(table.tenantId, ctx.user.tenantId)
+   */
+  scope?: (ctx: TContext, table: PgTable, operation: CrudOperation) => SQL | undefined;
+  /**
+   * 强制注入字段（写入时）
+   * 返回的字段会强制覆盖用户输入（防止伪造）
+   *
+   * @example
+   * inject: (ctx) => ({ tenantId: ctx.user.tenantId, createdBy: ctx.user.id })
+   */
+  inject?: (ctx: TContext, operation: WriteOperation) => Record<string, unknown>;
+  /**
+   * 资源级检查（ABAC）
+   * 在 get/update/delete 时，预取资源后调用
+   *
+   * @example
+   * authorize: (ctx, resource, op) => resource.ownerId === ctx.user.id
+   */
+  authorize?: (ctx: TContext, resource: TSelect, operation: CrudOperation) => boolean | Promise<boolean>;
+  /** 查询返回 Schema */
+  selectSchema?: z.ZodType<TSelect>;
   /** ID 字段名，默认 "id" */
   idField?: string;
   /** 可过滤的列白名单 */
@@ -256,90 +378,6 @@ interface CrudRouterConfigBase<TContext = unknown, TSelect = unknown, TInsert =
    */
   middleware?: CrudMiddleware<TContext, TSelect, TInsert, TUpdate>;
 }
-interface DeclarativeConfig<TContext = unknown, TSelect = unknown, TInsert = unknown, TUpdate = unknown> extends CrudRouterConfigBase<TContext, TSelect, TInsert, TUpdate> {
-  mode?: "declarative";
-  /**
-   * 基础 procedure（认证）
-   * 所有操作共用，除非被 guard 拦截
-   */
-  procedure?: AnyProcedure;
-  /**
-   * 操作级守卫（RBAC）
-   * 在 scope 之前执行，快速拒绝无权限请求
-   *
-   * @example
-   * guard: (ctx, op) => op === 'delete' ? ctx.user.role === 'admin' : true
-   */
-  guard?: (ctx: TContext, operation: CrudOperation) => boolean | Promise<boolean>;
-  /**
-   * 行级过滤（RLS）
-   * 返回 SQL 条件，自动注入到 WHERE 子句
-   *
-   * @example
-   * scope: (ctx, table) => eq(table.tenantId, ctx.user.tenantId)
-   */
-  scope?: (ctx: TContext, table: PgTable, operation: CrudOperation) => SQL | undefined;
-  /**
-   * 强制注入字段（写入时）
-   * 返回的字段会强制覆盖用户输入（防止伪造）
-   *
-   * @example
-   * inject: (ctx) => ({ tenantId: ctx.user.tenantId, createdBy: ctx.user.id })
-   */
-  inject?: (ctx: TContext, operation: WriteOperation) => Record<string, unknown>;
-  /**
-   * 资源级检查（ABAC）
-   * 在 get/update/delete 时，预取资源后调用
-   *
-   * @example
-   * authorize: (ctx, resource, op) => resource.ownerId === ctx.user.id
-   */
-  authorize?: (ctx: TContext, resource: TSelect, operation: CrudOperation) => boolean | Promise<boolean>;
-}
-interface FactoryConfig<TContext = unknown, TSelect = unknown, TInsert = unknown, TUpdate = unknown> extends CrudRouterConfigBase<TContext, TSelect, TInsert, TUpdate> {
-  mode: "factory";
-  /**
-   * Procedure 工厂函数
-   * 根据操作类型返回对应的 procedure
-   *
-   * @example
-   * procedureFactory: (op) => {
-   *   if (['list', 'get'].includes(op)) return publicProcedure;
-   *   return protectedProcedure.meta({ permission: { action: op, subject: 'Task' } });
-   * }
-   */
-  procedureFactory: (operation: CrudOperation) => AnyProcedure;
-  /**
-   * 强制注入字段（可选）
-   * 如果 DB 层已处理则不需要
-   */
-  inject?: (ctx: TContext, operation: WriteOperation) => Record<string, unknown>;
-}
-interface ProceduresConfig<TContext = unknown, TSelect = unknown, TInsert = unknown, TUpdate = unknown> extends CrudRouterConfigBase<TContext, TSelect, TInsert, TUpdate> {
-  mode: "procedures";
-  /**
-   * 按操作指定不同的 procedure
-   *
-   * @example
-   * procedures: {
-   *   list: publicProcedure,
-   *   get: publicProcedure,
-   *   create: editorProcedure,
-   *   update: editorProcedure,
-   *   delete: adminProcedure,
-   * }
-   */
-  procedures: Partial<Record<CrudOperation, AnyProcedure>>;
-  /**
-   * 默认 procedure（未指定操作时使用）
-   */
-  defaultProcedure?: AnyProcedure;
-  /**
-   * 强制注入字段（可选）
-   */
-  inject?: (ctx: TContext, operation: WriteOperation) => Record<string, unknown>;
-}
-type CrudRouterConfig<TContext = unknown, TSelect = unknown, TInsert = unknown, TUpdate = unknown> = DeclarativeConfig<TContext, TSelect, TInsert, TUpdate> | FactoryConfig<TContext, TSelect, TInsert, TUpdate> | ProceduresConfig<TContext, TSelect, TInsert, TUpdate>;
 interface CrudProcedures<TSelect, TInsert, TUpdate> {
   list: AnyProcedure;
   get: AnyProcedure;
@@ -430,4 +468,4 @@ declare const appRouter: _trpc_server2.TRPCBuiltRouter<{
 }, _trpc_server2.TRPCDecorateCreateRouterOptions<{}>>;
 type AppRouter = typeof appRouter;
 //#endregion
-export { type AnyProcedure, type AppRouter, type CreateMiddlewareParams, type CrudMiddleware, type CrudOperation, type CrudProcedures, type CrudRouterConfig, type CrudRouterConfigBase, type DeclarativeConfig, type DeleteManyMiddlewareParams, type DeleteMiddlewareParams, type FactoryConfig, type GetMiddlewareParams, type ListInput, type ListMiddlewareParams, type ListResult, type ProceduresConfig, type SoftDeleteConfig, type SoftDeleteOption, type UpdateManyMiddlewareParams, type UpdateMiddlewareParams, type UpsertMiddlewareParams, type WriteOperation, afterMiddleware, appRouter, beforeMiddleware, composeMiddleware, createCrudRouter, publicProcedure, router };
+export { type AnyProcedure, type AppRouter, type CreateMiddlewareParams, type CrudMiddleware, type CrudOperation, type CrudProcedures, type CrudRouterConfig, type DeleteManyMiddlewareParams, type DeleteMiddlewareParams, type GetMiddlewareParams, type ListInput, type ListMiddlewareParams, type ListResult, type ProcedureConfig, type ProcedureFactory, type ProcedureMap, type SoftDeleteConfig, type SoftDeleteOption, type UpdateManyMiddlewareParams, type UpdateMiddlewareParams, type UpsertMiddlewareParams, type WriteOperation, afterMiddleware, appRouter, beforeMiddleware, composeMiddleware, createCrudRouter, publicProcedure, router };

package/dist/index.d.ts

@@ -192,15 +192,137 @@ interface CrudMiddleware<TContext = unknown, TSelect = unknown, TInsert = unknow
     isNew: boolean;
   }>;
 }
-interface CrudRouterConfigBase<TContext = unknown, TSelect = unknown, TInsert = unknown, TUpdate = unknown> {
+/**
+ * Procedure 映射对象
+ * 按操作指定不同的 procedure，支持 default 回退
+ */
+interface ProcedureMap {
+  list?: AnyProcedure;
+  get?: AnyProcedure;
+  create?: AnyProcedure;
+  update?: AnyProcedure;
+  delete?: AnyProcedure;
+  deleteMany?: AnyProcedure;
+  updateMany?: AnyProcedure;
+  upsert?: AnyProcedure;
+  /** 未指定操作时的默认 procedure */
+  default?: AnyProcedure;
+}
+/**
+ * Procedure 工厂函数
+ * 根据操作类型动态返回 procedure
+ */
+type ProcedureFactory = (operation: CrudOperation) => AnyProcedure;
+/**
+ * 统一的 Procedure 配置
+ * 支持三种形式：
+ * 1. 单一 procedure - 所有操作共用
+ * 2. 对象映射 - 按操作指定
+ * 3. 工厂函数 - 动态生成
+ *
+ * @example
+ * // 形式 1：单一 procedure
+ * procedure: protectedProcedure
+ *
+ * // 形式 2：对象映射（推荐常用场景）
+ * procedure: {
+ *   list: publicProcedure,
+ *   get: publicProcedure,
+ *   create: editorProcedure,
+ *   delete: adminProcedure,
+ *   default: protectedProcedure,
+ * }
+ *
+ * // 形式 3：工厂函数（适合复杂逻辑）
+ * procedure: (op) => {
+ *   if (['list', 'get'].includes(op)) return publicProcedure;
+ *   return protectedProcedure.meta({ permission: { action: op, subject: 'Task' } });
+ * }
+ */
+type ProcedureConfig = AnyProcedure | ProcedureMap | ProcedureFactory;
+/**
+ * CRUD Router 配置
+ *
+ * v2.0 统一 API 设计：
+ * - 所有配置项可自由组合，无互斥模式
+ * - procedure 支持多种形式（单一/映射/工厂）
+ * - guard/scope/authorize 可与任意 procedure 形式组合
+ *
+ * @example
+ * // 简单场景：公开读，保护写
+ * createCrudRouter({
+ *   table: posts,
+ *   insertSchema,
+ *   updateSchema,
+ *   procedure: {
+ *     list: publicProcedure,
+ *     get: publicProcedure,
+ *     default: protectedProcedure,
+ *   },
+ * })
+ *
+ * // 复杂场景：自定义 procedure + 行级安全
+ * createCrudRouter({
+ *   table: posts,
+ *   insertSchema,
+ *   updateSchema,
+ *   procedure: adminProcedure,
+ *   scope: (ctx, table) => eq(table.tenantId, ctx.user.tenantId),
+ *   authorize: (ctx, resource) => resource.ownerId === ctx.user.id,
+ * })
+ */
+interface CrudRouterConfig<TContext = unknown, TSelect = unknown, TInsert = unknown, TUpdate = unknown> {
   /** Drizzle 表定义 */
   table: PgTable;
-  /** 查询返回 Schema */
-  selectSchema?: z.ZodType<TSelect>;
   /** 创建输入 Schema */
   insertSchema: z.ZodType<TInsert>;
   /** 更新输入 Schema */
   updateSchema: z.ZodType<TUpdate>;
+  /**
+   * Procedure 配置（统一字段）
+   *
+   * 支持三种形式：
+   * 1. 单一 procedure - 所有操作共用
+   * 2. 对象映射 - 按操作指定（推荐）
+   * 3. 工厂函数 - 动态生成
+   *
+   * 默认: publicProcedure
+   */
+  procedure?: ProcedureConfig;
+  /**
+   * 操作级守卫（RBAC）
+   * 在 scope 之前执行，快速拒绝无权限请求
+   *
+   * @example
+   * guard: (ctx, op) => op === 'delete' ? ctx.user.role === 'admin' : true
+   */
+  guard?: (ctx: TContext, operation: CrudOperation) => boolean | Promise<boolean>;
+  /**
+   * 行级过滤（RLS）
+   * 返回 SQL 条件，自动注入到 WHERE 子句
+   *
+   * @example
+   * scope: (ctx, table) => eq(table.tenantId, ctx.user.tenantId)
+   */
+  scope?: (ctx: TContext, table: PgTable, operation: CrudOperation) => SQL | undefined;
+  /**
+   * 强制注入字段（写入时）
+   * 返回的字段会强制覆盖用户输入（防止伪造）
+   *
+   * @example
+   * inject: (ctx) => ({ tenantId: ctx.user.tenantId, createdBy: ctx.user.id })
+   */
+  inject?: (ctx: TContext, operation: WriteOperation) => Record<string, unknown>;
+  /**
+   * 资源级检查（ABAC）
+   * 在 get/update/delete 时，预取资源后调用
+   *
+   * @example
+   * authorize: (ctx, resource, op) => resource.ownerId === ctx.user.id
+   */
+  authorize?: (ctx: TContext, resource: TSelect, operation: CrudOperation) => boolean | Promise<boolean>;
+  /** 查询返回 Schema */
+  selectSchema?: z.ZodType<TSelect>;
   /** ID 字段名，默认 "id" */
   idField?: string;
   /** 可过滤的列白名单 */
@@ -257,90 +379,6 @@ interface CrudRouterConfigBase<TContext = unknown, TSelect = unknown, TInsert =
    */
   middleware?: CrudMiddleware<TContext, TSelect, TInsert, TUpdate>;
 }
-interface DeclarativeConfig<TContext = unknown, TSelect = unknown, TInsert = unknown, TUpdate = unknown> extends CrudRouterConfigBase<TContext, TSelect, TInsert, TUpdate> {
-  mode?: "declarative";
-  /**
-   * 基础 procedure（认证）
-   * 所有操作共用，除非被 guard 拦截
-   */
-  procedure?: AnyProcedure;
-  /**
-   * 操作级守卫（RBAC）
-   * 在 scope 之前执行，快速拒绝无权限请求
-   *
-   * @example
-   * guard: (ctx, op) => op === 'delete' ? ctx.user.role === 'admin' : true
-   */
-  guard?: (ctx: TContext, operation: CrudOperation) => boolean | Promise<boolean>;
-  /**
-   * 行级过滤（RLS）
-   * 返回 SQL 条件，自动注入到 WHERE 子句
-   *
-   * @example
-   * scope: (ctx, table) => eq(table.tenantId, ctx.user.tenantId)
-   */
-  scope?: (ctx: TContext, table: PgTable, operation: CrudOperation) => SQL | undefined;
-  /**
-   * 强制注入字段（写入时）
-   * 返回的字段会强制覆盖用户输入（防止伪造）
-   *
-   * @example
-   * inject: (ctx) => ({ tenantId: ctx.user.tenantId, createdBy: ctx.user.id })
-   */
-  inject?: (ctx: TContext, operation: WriteOperation) => Record<string, unknown>;
-  /**
-   * 资源级检查（ABAC）
-   * 在 get/update/delete 时，预取资源后调用
-   *
-   * @example
-   * authorize: (ctx, resource, op) => resource.ownerId === ctx.user.id
-   */
-  authorize?: (ctx: TContext, resource: TSelect, operation: CrudOperation) => boolean | Promise<boolean>;
-}
-interface FactoryConfig<TContext = unknown, TSelect = unknown, TInsert = unknown, TUpdate = unknown> extends CrudRouterConfigBase<TContext, TSelect, TInsert, TUpdate> {
-  mode: "factory";
-  /**
-   * Procedure 工厂函数
-   * 根据操作类型返回对应的 procedure
-   *
-   * @example
-   * procedureFactory: (op) => {
-   *   if (['list', 'get'].includes(op)) return publicProcedure;
-   *   return protectedProcedure.meta({ permission: { action: op, subject: 'Task' } });
-   * }
-   */
-  procedureFactory: (operation: CrudOperation) => AnyProcedure;
-  /**
-   * 强制注入字段（可选）
-   * 如果 DB 层已处理则不需要
-   */
-  inject?: (ctx: TContext, operation: WriteOperation) => Record<string, unknown>;
-}
-interface ProceduresConfig<TContext = unknown, TSelect = unknown, TInsert = unknown, TUpdate = unknown> extends CrudRouterConfigBase<TContext, TSelect, TInsert, TUpdate> {
-  mode: "procedures";
-  /**
-   * 按操作指定不同的 procedure
-   *
-   * @example
-   * procedures: {
-   *   list: publicProcedure,
-   *   get: publicProcedure,
-   *   create: editorProcedure,
-   *   update: editorProcedure,
-   *   delete: adminProcedure,
-   * }
-   */
-  procedures: Partial<Record<CrudOperation, AnyProcedure>>;
-  /**
-   * 默认 procedure（未指定操作时使用）
-   */
-  defaultProcedure?: AnyProcedure;
-  /**
-   * 强制注入字段（可选）
-   */
-  inject?: (ctx: TContext, operation: WriteOperation) => Record<string, unknown>;
-}
-type CrudRouterConfig<TContext = unknown, TSelect = unknown, TInsert = unknown, TUpdate = unknown> = DeclarativeConfig<TContext, TSelect, TInsert, TUpdate> | FactoryConfig<TContext, TSelect, TInsert, TUpdate> | ProceduresConfig<TContext, TSelect, TInsert, TUpdate>;
 interface CrudProcedures<TSelect, TInsert, TUpdate> {
   list: AnyProcedure;
   get: AnyProcedure;
@@ -431,4 +469,4 @@ declare const appRouter: _trpc_server2.TRPCBuiltRouter<{
 }, _trpc_server2.TRPCDecorateCreateRouterOptions<{}>>;
 type AppRouter = typeof appRouter;
 //#endregion
-export { type AnyProcedure, type AppRouter, type CreateMiddlewareParams, type CrudMiddleware, type CrudOperation, type CrudProcedures, type CrudRouterConfig, type CrudRouterConfigBase, type DeclarativeConfig, type DeleteManyMiddlewareParams, type DeleteMiddlewareParams, type FactoryConfig, type GetMiddlewareParams, type ListInput, type ListMiddlewareParams, type ListResult, type ProceduresConfig, type SoftDeleteConfig, type SoftDeleteOption, type UpdateManyMiddlewareParams, type UpdateMiddlewareParams, type UpsertMiddlewareParams, type WriteOperation, afterMiddleware, appRouter, beforeMiddleware, composeMiddleware, createCrudRouter, publicProcedure, router };
+export { type AnyProcedure, type AppRouter, type CreateMiddlewareParams, type CrudMiddleware, type CrudOperation, type CrudProcedures, type CrudRouterConfig, type DeleteManyMiddlewareParams, type DeleteMiddlewareParams, type GetMiddlewareParams, type ListInput, type ListMiddlewareParams, type ListResult, type ProcedureConfig, type ProcedureFactory, type ProcedureMap, type SoftDeleteConfig, type SoftDeleteOption, type UpdateManyMiddlewareParams, type UpdateMiddlewareParams, type UpsertMiddlewareParams, type WriteOperation, afterMiddleware, appRouter, beforeMiddleware, composeMiddleware, createCrudRouter, publicProcedure, router };

package/dist/index.js

@@ -1,6 +1,6 @@
 import { z } from "zod";
 import { and, asc, desc, eq, gt, gte, ilike, inArray, isNull, lt, lte, ne, not, notIlike, notInArray, or, sql } from "drizzle-orm";
-import { initTRPC } from "@trpc/server";
+import { TRPCError, initTRPC } from "@trpc/server";
 import superjson from "superjson";
 import { addDays, endOfDay, startOfDay } from "date-fns";
 
@@ -389,38 +389,53 @@ function resolveSoftDelete(option) {
 		getValue: config.value ?? (() => /* @__PURE__ */ new Date())
 	};
 }
-function resolveConfig(config) {
-	const mode = config.mode || "declarative";
-	if (mode === "factory") {
-		const factoryConfig = config;
-		return {
-			procedureFactory: factoryConfig.procedureFactory,
-			guard: void 0,
-			getScope: () => void 0,
-			getInject: (ctx, op) => factoryConfig.inject?.(ctx, op) ?? {},
-			checkAuthorize: async () => true
-		};
+/**
+* 判断 procedure 配置的类型
+*/
+function isProcedureMap(config) {
+	if (!config) return false;
+	if (typeof config === "function") return false;
+	if (typeof config === "object" && config !== null) {
+		const keys = Object.keys(config);
+		const validKeys = [
+			"list",
+			"get",
+			"create",
+			"update",
+			"delete",
+			"deleteMany",
+			"updateMany",
+			"upsert",
+			"default"
+		];
+		return keys.some((k) => validKeys.includes(k));
 	}
-	if (mode === "procedures") {
-		const proceduresConfig = config;
-		const defaultProc = proceduresConfig.defaultProcedure ?? publicProcedure;
-		return {
-			procedureFactory: (op) => proceduresConfig.procedures[op] ?? defaultProc,
-			guard: void 0,
-			getScope: () => void 0,
-			getInject: (ctx, op) => proceduresConfig.inject?.(ctx, op) ?? {},
-			checkAuthorize: async () => true
-		};
+	return false;
+}
+function isProcedureFactory(config) {
+	return typeof config === "function";
+}
+/**
+* 解析 procedure 配置为工厂函数
+*/
+function resolveProcedureFactory(config) {
+	if (!config) return () => publicProcedure;
+	if (isProcedureFactory(config)) return config;
+	if (isProcedureMap(config)) {
+		const map = config;
+		const defaultProc = map.default ?? publicProcedure;
+		return (op) => map[op] ?? defaultProc;
 	}
-	const declarativeConfig = config;
-	const baseProcedure = declarativeConfig.procedure ?? publicProcedure;
+	return () => config;
+}
+function resolveConfig(config) {
 	return {
-		procedureFactory: () => baseProcedure,
-		guard: declarativeConfig.guard,
-		getScope: (ctx, tbl, op) => declarativeConfig.scope?.(ctx, tbl, op),
-		getInject: (ctx, op) => declarativeConfig.inject?.(ctx, op) ?? {},
+		procedureFactory: resolveProcedureFactory(config.procedure),
+		guard: config.guard,
+		getScope: (ctx, tbl, op) => config.scope?.(ctx, tbl, op),
+		getInject: (ctx, op) => config.inject?.(ctx, op) ?? {},
 		checkAuthorize: async (ctx, resource, op) => {
-			if (declarativeConfig.authorize) return declarativeConfig.authorize(ctx, resource, op);
+			if (config.authorize) return config.authorize(ctx, resource, op);
 			return true;
 		}
 	};
@@ -465,7 +480,7 @@ function createCrudRouter(config) {
 		const conditions = [];
 		const scopeCondition = resolved.getScope(ctx, table, operation);
 		if (scopeCondition) conditions.push(scopeCondition);
-		if (softDelete && (operation === "list" || operation === "get")) {
+		if (softDelete) {
 			const col = getSoftDeleteColumn();
 			if (col) conditions.push(isNull(col));
 		}
@@ -479,15 +494,24 @@ function createCrudRouter(config) {
 			if (operation === "upsert") {
 				const canCreate = await resolved.guard(ctx, "create");
 				const canUpdate = await resolved.guard(ctx, "update");
-				if (!canCreate || !canUpdate) throw new Error("Forbidden: upsert requires both create and update permissions");
+				if (!canCreate || !canUpdate) throw new TRPCError({
+					code: "FORBIDDEN",
+					message: "Forbidden: upsert requires both create and update permissions"
+				});
 				return;
 			}
-			if (!await resolved.guard(ctx, operation)) throw new Error(`Forbidden: ${operation} not allowed`);
+			if (!await resolved.guard(ctx, operation)) throw new TRPCError({
+				code: "FORBIDDEN",
+				message: `Forbidden: ${operation} not allowed`
+			});
 		}
 	};
 	const withAuthorize = async (ctx, resource, operation) => {
 		if (!resource) return;
-		if (!await resolved.checkAuthorize(ctx, resource, operation)) throw new Error(`Forbidden: Cannot ${operation} this resource`);
+		if (!await resolved.checkAuthorize(ctx, resource, operation)) throw new TRPCError({
+			code: "FORBIDDEN",
+			message: `Forbidden: Cannot ${operation} this resource`
+		});
 	};
 	const procedures = {
 		list: resolved.procedureFactory("list").input(listInputSchema).query(async ({ ctx, input }) => {
@@ -570,7 +594,10 @@ function createCrudRouter(config) {
 			const where = buildWhere(ctx, "update", eq(getIdColumn(), input.id));
 			const [existing] = await ctx.db.select().from(table).where(where);
 			await withAuthorize(ctx, existing, "update");
-			if (!existing) throw new Error("Resource not found or access denied");
+			if (!existing) throw new TRPCError({
+				code: "NOT_FOUND",
+				message: "Resource not found or access denied"
+			});
 			const doUpdate = async (updateData) => {
 				const injectData = resolved.getInject(ctx, "update");
 				const data = {
@@ -594,7 +621,10 @@ function createCrudRouter(config) {
 			const where = buildWhere(ctx, "delete", eq(getIdColumn(), input));
 			const [existing] = await ctx.db.select().from(table).where(where);
 			await withAuthorize(ctx, existing, "delete");
-			if (!existing) throw new Error("Resource not found or access denied");
+			if (!existing) throw new TRPCError({
+				code: "NOT_FOUND",
+				message: "Resource not found or access denied"
+			});
 			const doDelete = async () => {
 				let deleted;
 				if (softDelete) [deleted] = await ctx.db.update(table).set({ [softDelete.column]: softDelete.getValue() }).where(where).returning();
@@ -613,8 +643,8 @@ function createCrudRouter(config) {
 			await withGuard(ctx, "deleteMany");
 			const where = buildWhere(ctx, "deleteMany", inArray(getIdColumn(), input));
 			const doDeleteMany = async () => {
-				if (softDelete) return { deleted: (await ctx.db.update(table).set({ [softDelete.column]: softDelete.getValue() }).where(where).returning()).length };
-				else return { deleted: (await ctx.db.delete(table).where(where).returning()).length };
+				if (softDelete) return { deleted: (await ctx.db.update(table).set({ [softDelete.column]: softDelete.getValue() }).where(where).returning({ id: getIdColumn() })).length };
+				else return { deleted: (await ctx.db.delete(table).where(where).returning({ id: getIdColumn() })).length };
 			};
 			if (m.deleteMany) return m.deleteMany({
 				ctx,
@@ -635,7 +665,7 @@ function createCrudRouter(config) {
 					...updateData,
 					...injectData
 				};
-				return { updated: (await ctx.db.update(table).set(data).where(where).returning()).length };
+				return { updated: (await ctx.db.update(table).set(data).where(where).returning({ id: getIdColumn() })).length };
 			};
 			if (m.updateMany) return m.updateMany({
 				ctx,
@@ -648,21 +678,27 @@ function createCrudRouter(config) {
 		upsert: resolved.procedureFactory("upsert").input(insertSchema).mutation(async ({ ctx, input }) => {
 			await withGuard(ctx, "upsert");
 			const doUpsert = async (inputData) => {
-				const injectData = resolved.getInject(ctx, "create");
-				const data = {
-					...inputData,
-					...injectData
-				};
 				const inputId = inputData[idField];
 				let isNew = true;
+				let existing = null;
 				if (inputId) {
 					const where = buildWhere(ctx, "get", eq(getIdColumn(), inputId));
-					const [existing] = await ctx.db.select().from(table).where(where);
+					const [found] = await ctx.db.select().from(table).where(where);
+					existing = found;
 					isNew = !existing;
+					if (!isNew && existing) await withAuthorize(ctx, existing, "update");
 				}
+				const injectData = resolved.getInject(ctx, isNew ? "create" : "update");
+				const data = {
+					...inputData,
+					...injectData
+				};
 				const [result] = await ctx.db.insert(table).values(data).onConflictDoUpdate({
 					target: getIdColumn(),
-					set: data
+					set: {
+						...inputData,
+						...resolved.getInject(ctx, "update")
+					}
 				}).returning();
 				return {
 					data: result,

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@wordrhyme/auto-crud-server",
   "type": "module",
-  "version": "0.6.1",
+  "version": "0.7.0",
   "description": "tRPC server utilities for auto-crud - automatic CRUD routers for Drizzle ORM",
   "author": "wordrhyme",
   "license": "MIT",
@@ -45,10 +45,11 @@
     "superjson": "^2.2.6",
     "tsdown": "^0.15.12",
     "typescript": "^5.9.3",
+    "vitest": "^4.0.18",
     "zod": "^4.1.13",
     "@internal/eslint-config": "0.3.0",
-    "@internal/prettier-config": "0.0.1",
     "@internal/tsconfig": "0.1.0",
+    "@internal/prettier-config": "0.0.1",
     "@internal/vitest-config": "0.1.0",
     "@internal/tsdown-config": "0.1.0"
   },
@@ -60,6 +61,7 @@
     "build:watch": "tsdown --watch",
     "test": "vitest --run --passWithNoTests",
     "test:watch": "vitest --watch",
+    "test:coverage": "vitest --run --coverage",
     "typecheck": "tsc --noEmit",
     "lint": "eslint",
     "format": "prettier --check . --ignore-path ../../.gitignore"