alepha 0.23.0 → 0.24.0

package/src/orm/__tests__/enums.spec.ts

@@ -1,74 +1,78 @@
-import { Alepha, t } from "alepha";
+import { Alepha, z } from "alepha";
 import { describe, expect, it } from "vitest";
 import { $entity, $repository, DrizzleKitProvider, db } from "../core/index.ts";
 import { AlephaOrmPostgres } from "../postgres/index.ts";
 
-// Test 1: t.enum with mode: "text" (should map to TEXT column)
+// Test 1: z.enum with mode: "text" (should map to TEXT column)
 const textEnumEntity = $entity({
   name: "text_enum_test",
-  schema: t.object({
+  schema: z.object({
     id: db.primaryKey(),
-    status: t.enum(["pending", "active", "archived"], { mode: "text" }),
-    role: t.enum(["user", "admin", "moderator"], { mode: "text" }),
+    status: z.enum(["pending", "active", "archived"]).meta({ mode: "text" }),
+    role: z.enum(["user", "admin", "moderator"]).meta({ mode: "text" }),
   }),
 });
 
-// Test 2: t.enum without mode (should create real PG ENUM type)
+// Test 2: z.enum without mode (should create real PG ENUM type)
 const pgEnumEntity = $entity({
   name: "pg_enum_test",
-  schema: t.object({
+  schema: z.object({
     id: db.primaryKey(),
-    status: t.enum(["draft", "published", "deleted"]),
-    priority: t.enum(["low", "medium", "high"]),
+    status: z.enum(["draft", "published", "deleted"]),
+    priority: z.enum(["low", "medium", "high"]),
   }),
 });
 
 // Test 3: Mixed text and pg enum in the same table
 const mixedEnumEntity = $entity({
   name: "mixed_enum_test",
-  schema: t.object({
+  schema: z.object({
     id: db.primaryKey(),
-    textStatus: t.enum(["open", "closed"], { mode: "text" }),
-    pgStatus: t.enum(["new", "in_progress", "done"]),
+    textStatus: z.enum(["open", "closed"]).meta({ mode: "text" }),
+    pgStatus: z.enum(["new", "in_progress", "done"]),
   }),
 });
 
 // Test 4: Shared enum with custom name across two tables
 const sharedEnumEntity1 = $entity({
   name: "shared_enum_test_1",
-  schema: t.object({
+  schema: z.object({
     id: db.primaryKey(),
-    status: t.enum(["enabled", "disabled"], { name: "shared_status_enum" }),
+    status: z
+      .enum(["enabled", "disabled"])
+      .meta({ name: "shared_status_enum" }),
   }),
 });
 
 const sharedEnumEntity2 = $entity({
   name: "shared_enum_test_2",
-  schema: t.object({
+  schema: z.object({
     id: db.primaryKey(),
-    status: t.enum(["enabled", "disabled"], { name: "shared_status_enum" }),
+    status: z
+      .enum(["enabled", "disabled"])
+      .meta({ name: "shared_status_enum" }),
   }),
 });
 
 // Test 5: Conflicting enum - same name but different values (should throw error)
 const conflictEnumEntity1 = $entity({
   name: "conflict_enum_test_1",
-  schema: t.object({
+  schema: z.object({
     id: db.primaryKey(),
-    status: t.enum(["a", "b", "c"], { name: "conflict_status_enum" }),
+    status: z.enum(["a", "b", "c"]).meta({ name: "conflict_status_enum" }),
   }),
 });
 
 const conflictEnumEntity2 = $entity({
   name: "conflict_enum_test_2",
-  schema: t.object({
+  schema: z.object({
     id: db.primaryKey(),
-    status: t.enum(["a", "b", "d"], { name: "conflict_status_enum" }), // Different value!
+    status: z.enum(["a", "b", "d"]).meta({ name: "conflict_status_enum" }), // Different value!
   }),
 });
 
-describe("enums - t.enum with mode: 'text' (TEXT column)", () => {
-  it("should create TEXT columns for t.enum fields with mode: 'text'", async () => {
+describe("enums - z.enum with mode: 'text' (TEXT column)", () => {
+  it("should create TEXT columns for z.enum fields with mode: 'text'", async () => {
     const alepha = Alepha.create().with(AlephaOrmPostgres);
 
     class App {
@@ -117,8 +121,8 @@ describe("enums - t.enum with mode: 'text' (TEXT column)", () => {
   });
 });
 
-describe("enums - t.enum (real PG ENUM type)", () => {
-  it("should create real PostgreSQL ENUM types for t.enum fields", async () => {
+describe("enums - z.enum (real PG ENUM type)", () => {
+  it("should create real PostgreSQL ENUM types for z.enum fields", async () => {
     const alepha = Alepha.create().with(AlephaOrmPostgres);
 
     class App {
@@ -137,7 +141,7 @@ describe("enums - t.enum (real PG ENUM type)", () => {
 
     expect(sql).toContainEqual(expect.stringContaining("CREATE TABLE"));
     expect(sql).toContainEqual(expect.stringContaining("pg_enum_test"));
-    // t.enum without mode should create real ENUM types
+    // z.enum without mode should create real ENUM types
     expect(
       sql.some((s) => s.includes("CREATE TYPE") || s.includes("DO $$ BEGIN")),
     ).toBe(true);

package/src/orm/__tests__/execute-tests.ts

@@ -1,14 +1,14 @@
-import { type Alepha, TypeBoxError, t } from "alepha";
+import { type Alepha, TypeBoxError, z } from "alepha";
 import { eq } from "drizzle-orm";
 import { expect } from "vitest";
 import { $entity, $repository, db, sql } from "../core/index.ts";
 
 const userEntity = $entity({
   name: "users",
-  schema: t.object({
-    id: db.primaryKey(t.int64()),
-    name: t.text(),
-    guildId: t.optional(t.integer()),
+  schema: z.object({
+    id: db.primaryKey(z.int64()),
+    name: z.text(),
+    guildId: z.integer().optional(),
   }),
   indexes: [{ column: "name", unique: true }],
 });
@@ -29,7 +29,7 @@ export const testExecuteBasicSqlQueries = async (alepha: Alepha) => {
   expect(
     await app.users.query(
       (t) => sql`SELECT * FROM ${t} WHERE ${t.name} = ${name}`,
-      t.pick(userEntity.schema, ["name"]),
+      userEntity.schema.pick({ name: true }),
     ),
   ).toEqual([
     {
@@ -40,7 +40,7 @@ export const testExecuteBasicSqlQueries = async (alepha: Alepha) => {
   expect(
     await app.users.query(
       (t, db) => db.select({ name: t.name }).from(t).where(eq(t.name, name)),
-      t.pick(userEntity.schema, ["name"]),
+      userEntity.schema.pick({ name: true }),
     ),
   ).toEqual([
     {
@@ -51,7 +51,7 @@ export const testExecuteBasicSqlQueries = async (alepha: Alepha) => {
   expect(
     await app.users.query(
       (t) => sql`SELECT ${t.name} FROM ${t} WHERE ${t.name} = ${name}`,
-      t.pick(userEntity.schema, ["name"]),
+      userEntity.schema.pick({ name: true }),
     ),
   ).toEqual([
     {

package/src/orm/__tests__/fixtures/bigEntitySchema.ts

@@ -1,64 +1,64 @@
 import type { Static } from "alepha";
-import { t } from "alepha";
+import { z } from "alepha";
 import { $entity, db } from "../../core/index.ts";
 
 export const bigEntity = $entity({
   name: "big_entity",
-  schema: t.object({
-    id: db.primaryKey(t.bigint()),
-    type: t.enum(["big_entity"]),
-    date: t.date(),
-    a: t.text(),
-    b: t.number(),
-    c: t.integer(),
-    d: t.boolean(),
-    e: t.object({
-      a: t.text(),
-      b: t.number(),
-      c: t.integer(),
-      d: t.boolean(),
-      e: t.object({
-        a: t.text(),
-        b: t.number(),
-        c: t.integer(),
-        d: t.boolean(),
-        j: t.array(
-          t.object({
-            a: t.text(),
-            b: t.number(),
-            c: t.integer(),
-            d: t.boolean(),
-            e: t.object({
-              a: t.text(),
-              b: t.number(),
-              c: t.integer(),
-              d: t.boolean(),
+  schema: z.object({
+    id: db.primaryKey(z.bigint()),
+    type: z.enum(["big_entity"]),
+    date: z.date(),
+    a: z.text(),
+    b: z.number(),
+    c: z.integer(),
+    d: z.boolean(),
+    e: z.object({
+      a: z.text(),
+      b: z.number(),
+      c: z.integer(),
+      d: z.boolean(),
+      e: z.object({
+        a: z.text(),
+        b: z.number(),
+        c: z.integer(),
+        d: z.boolean(),
+        j: z.array(
+          z.object({
+            a: z.text(),
+            b: z.number(),
+            c: z.integer(),
+            d: z.boolean(),
+            e: z.object({
+              a: z.text(),
+              b: z.number(),
+              c: z.integer(),
+              d: z.boolean(),
             }),
           }),
         ),
       }),
     }),
-    f: t.array(t.text()),
-    g: t.array(t.number()),
-    h: t.array(t.integer()),
-    i: t.array(t.boolean()),
-    j: t.array(
-      t.object({
-        a: t.text(),
-        b: t.number(),
-        c: t.integer(),
-        d: t.boolean(),
-        e: t.object({
-          a: t.text(),
-          b: t.number(),
-          c: t.integer(),
-          d: t.boolean(),
+    f: z.array(z.text()),
+    g: z.array(z.number()),
+    h: z.array(z.integer()),
+    i: z.array(z.boolean()),
+    j: z.array(
+      z.object({
+        a: z.text(),
+        b: z.number(),
+        c: z.integer(),
+        d: z.boolean(),
+        e: z.object({
+          a: z.text(),
+          b: z.number(),
+          c: z.integer(),
+          d: z.boolean(),
         }),
       }),
     ),
-    k: t.datetime(),
-    l: t.uuid(),
-    m: t.enum(["a", "b", "c"]),
+    k: z.datetime(),
+    l: z.uuid(),
+    m: z.enum(["a", "b", "c"]),
   }),
 });
 

package/src/orm/__tests__/fixtures/userEntitySchema.ts

@@ -1,18 +1,18 @@
 import type { Static } from "alepha";
-import { t } from "alepha";
+import { z } from "alepha";
 import { $entity, db } from "../../core/index.ts";
 
 export const userEntity = $entity({
   name: "users",
-  schema: t.object({
+  schema: z.object({
     id: db.primaryKey(),
     createdAt: db.createdAt(),
     updatedAt: db.updatedAt(),
-    name: t.text(),
-    profile: t.object({
-      age: t.number(),
+    name: z.text(),
+    profile: z.object({
+      age: z.number(),
     }),
-    role: db.default(t.text(), "user"),
+    role: db.default(z.text(), "user"),
   }),
   indexes: [
     {

package/src/orm/__tests__/joins-tests.ts

@@ -1,5 +1,5 @@
 import type { Alepha } from "alepha";
-import { t } from "alepha";
+import { z } from "alepha";
 import { sql } from "drizzle-orm";
 import { expect } from "vitest";
 import { $entity, $repository, db } from "../core/index.ts";
@@ -10,80 +10,80 @@ import { $entity, $repository, db } from "../core/index.ts";
 
 const countries = $entity({
   name: "countries",
-  schema: t.object({
+  schema: z.object({
     id: db.primaryKey(),
-    name: t.text(),
-    code: t.text(),
+    name: z.text(),
+    code: z.text(),
   }),
 });
 
 const cities = $entity({
   name: "cities",
-  schema: t.object({
+  schema: z.object({
     id: db.primaryKey(),
-    countryId: db.ref(t.integer(), () => countries.cols.id),
-    name: t.text(),
-    population: t.optional(t.integer()),
+    countryId: db.ref(z.integer(), () => countries.cols.id),
+    name: z.text(),
+    population: z.integer().optional(),
   }),
 });
 
 const users = $entity({
   name: "users",
-  schema: t.object({
+  schema: z.object({
     id: db.primaryKey(),
-    name: t.text(),
-    email: t.text(),
-    cityId: db.ref(t.optional(t.integer()), () => cities.cols.id),
-    managerId: db.ref(t.optional(t.integer()), () => users.cols.id),
+    name: z.text(),
+    email: z.text(),
+    cityId: db.ref(z.integer().optional(), () => cities.cols.id),
+    managerId: db.ref(z.integer().optional(), () => users.cols.id),
   }),
 });
 
 const profiles = $entity({
   name: "profiles",
-  schema: t.object({
+  schema: z.object({
     id: db.primaryKey(),
-    userId: db.ref(t.integer(), () => users.cols.id),
-    bio: t.text(),
-    website: t.optional(t.text()),
+    userId: db.ref(z.integer(), () => users.cols.id),
+    bio: z.text(),
+    website: z.text().optional(),
   }),
 });
 
 const posts = $entity({
   name: "posts",
-  schema: t.object({
+  schema: z.object({
     id: db.primaryKey(),
-    authorId: db.ref(t.integer(), () => users.cols.id),
-    title: t.text(),
-    content: t.text(),
+    authorId: db.ref(z.integer(), () => users.cols.id),
+    title: z.text(),
+    content: z.text(),
     publishedAt: db.createdAt(),
   }),
 });
 
 const comments = $entity({
   name: "comments",
-  schema: t.object({
+  schema: z.object({
     id: db.primaryKey(),
-    postId: db.ref(t.integer(), () => posts.cols.id),
-    authorId: db.ref(t.integer(), () => users.cols.id),
-    content: t.text(),
+    postId: db.ref(z.integer(), () => posts.cols.id),
+    authorId: db.ref(z.integer(), () => users.cols.id),
+    content: z.text(),
     createdAt: db.createdAt(),
   }),
 });
 
 const tags = $entity({
   name: "tags",
-  schema: t.object({
+  schema: z.object({
     id: db.primaryKey(),
-    name: t.text(),
+    name: z.text(),
   }),
 });
 
 const postTags = $entity({
   name: "post_tags",
-  schema: t.object({
+  schema: z.object({
     id: db.primaryKey(),
-    postId: db.ref(t.integer(), () => posts.cols.id),
-    tagId: db.ref(t.integer(), () => tags.cols.id),
+    postId: db.ref(z.integer(), () => posts.cols.id),
+    tagId: db.ref(z.integer(), () => tags.cols.id),
   }),
 });
 

package/src/orm/__tests__/organization-tests.ts

@@ -1,14 +1,14 @@
-import { type Alepha, t } from "alepha";
+import { type Alepha, AlephaError, z } from "alepha";
 import { currentUserAtom } from "alepha/security";
 import { expect } from "vitest";
 import { $entity, $repository, db } from "../core/index.ts";
 
 const entity = $entity({
   name: "test_org_entity",
-  schema: t.object({
+  schema: z.object({
     id: db.primaryKey(),
     organization: db.organization(),
-    name: t.optional(t.text()),
+    name: z.text().optional(),
   }),
 });
 
@@ -22,6 +22,43 @@ const setup = async (alepha: Alepha) => {
   return { repository: app.repository, alepha };
 };
 
+// A tenant-scoped entity that opts into fail-closed semantics: no "global
+// row" visibility (the `IS NULL` escape is dropped) and queries/inserts with
+// no resolved tenant are refused rather than silently seeing/writing everything.
+// `nullable: true` is kept so a NULL row CAN be written directly (legacy data),
+// which lets us prove such a row is invisible to a scoped tenant.
+const strictEntity = $entity({
+  name: "test_org_strict_entity",
+  schema: z.object({
+    id: db.primaryKey(),
+    organization: db.organization({ strict: true, nullable: true }),
+    name: z.text().optional(),
+  }),
+});
+
+// A NON-strict view over the SAME physical table, used only to seed a legacy
+// NULL/global row — something a strict repository (correctly) refuses to write.
+// It lets us prove such a pre-existing row is invisible to a scoped tenant.
+const strictSeedEntity = $entity({
+  name: "test_org_strict_entity",
+  schema: z.object({
+    id: db.primaryKey(),
+    organization: db.organization(),
+    name: z.text().optional(),
+  }),
+});
+
+class StrictApp {
+  repository = $repository(strictEntity);
+  seed = $repository(strictSeedEntity);
+}
+
+const setupStrict = async (alepha: Alepha) => {
+  const app = alepha.inject(StrictApp);
+  await alepha.start();
+  return { repository: app.repository, seed: app.seed, alepha };
+};
+
 export const testOrgUserSeesOwnAndGlobalRows = async (alepha: Alepha) => {
   const { repository, alepha: app } = await setup(alepha);
 
@@ -177,6 +214,71 @@ export const testOrgFilterOnUpdateOne = async (alepha: Alepha) => {
   expect(check.name).toEqual("org-b-row");
 };
 
+export const testStrictHidesGlobalRows = async (alepha: Alepha) => {
+  const { repository, seed, alepha: app } = await setupStrict(alepha);
+
+  await repository.create({
+    name: "org-a-row",
+    organization: "a0000000-0000-0000-0000-000000000001",
+  });
+  await repository.create({
+    name: "org-b-row",
+    organization: "b0000000-0000-0000-0000-000000000002",
+  });
+  // A NULL/global row exists (e.g. legacy data written before the table was
+  // made strict) — seeded via the non-strict view over the same table.
+  await seed.create({ name: "global-row" });
+
+  app.store.set(currentUserAtom, {
+    id: "user-1",
+    organization: "a0000000-0000-0000-0000-000000000001",
+  });
+
+  // Strict: the org-a tenant must see ONLY its own row — the global NULL row
+  // is NOT visible (the `OR org IS NULL` escape is dropped).
+  const results = await repository.findMany();
+  expect(results.map((r: any) => r.name).sort()).toEqual(["org-a-row"]);
+  expect(await repository.count()).toEqual(1);
+};
+
+export const testStrictFailsClosedWithoutTenant = async (alepha: Alepha) => {
+  const { repository } = await setupStrict(alepha);
+
+  await repository.create({
+    name: "org-a-row",
+    organization: "a0000000-0000-0000-0000-000000000001",
+  });
+
+  // No tenant/user in context: a strict entity must REFUSE to return rows,
+  // not fall through to an unfiltered "see everything" query.
+  await expect(repository.findMany()).rejects.toThrow(AlephaError);
+  await expect(repository.count()).rejects.toThrow(AlephaError);
+};
+
+export const testStrictFailsClosedForOrglessUser = async (alepha: Alepha) => {
+  const { repository, alepha: app } = await setupStrict(alepha);
+
+  await repository.create({
+    name: "org-a-row",
+    organization: "a0000000-0000-0000-0000-000000000001",
+  });
+
+  // A user with no organization resolves no tenant → still fail closed
+  // (there is no "master sees everything" for a strict entity).
+  app.store.set(currentUserAtom, { id: "orgless-user" });
+  await expect(repository.findMany()).rejects.toThrow(AlephaError);
+};
+
+export const testStrictRefusesInsertWithoutTenant = async (alepha: Alepha) => {
+  const { repository } = await setupStrict(alepha);
+
+  // Inserting with neither an explicit org nor a resolved tenant would create
+  // an unscoped NULL row; strict refuses it.
+  await expect(repository.create({ name: "orphan" })).rejects.toThrow(
+    AlephaError,
+  );
+};
+
 export const testOrgFilterOnDelete = async (alepha: Alepha) => {
   const { repository, alepha: app } = await setup(alepha);
 

package/src/orm/__tests__/organization.spec.ts

@@ -11,6 +11,10 @@ import {
   testOrgFilterOnDelete,
   testOrgFilterOnUpdateOne,
   testOrgUserSeesOwnAndGlobalRows,
+  testStrictFailsClosedForOrglessUser,
+  testStrictFailsClosedWithoutTenant,
+  testStrictHidesGlobalRows,
+  testStrictRefusesInsertWithoutTenant,
 } from "./organization-tests.ts";
 
 describe("organization", () => {
@@ -100,4 +104,46 @@ describe("organization", () => {
   it("org filter on delete (postgres)", async () => {
     await testOrgFilterOnDelete(Alepha.create().with(AlephaOrmPostgres));
   });
+
+  it("strict: hides global/NULL rows from a scoped tenant (sqlite)", async () => {
+    await testStrictHidesGlobalRows(
+      Alepha.create({ env: { DATABASE_URL: "sqlite://:memory:" } }),
+    );
+  });
+  it("strict: hides global/NULL rows from a scoped tenant (postgres)", async () => {
+    await testStrictHidesGlobalRows(Alepha.create().with(AlephaOrmPostgres));
+  });
+
+  it("strict: fails closed with no tenant (sqlite)", async () => {
+    await testStrictFailsClosedWithoutTenant(
+      Alepha.create({ env: { DATABASE_URL: "sqlite://:memory:" } }),
+    );
+  });
+  it("strict: fails closed with no tenant (postgres)", async () => {
+    await testStrictFailsClosedWithoutTenant(
+      Alepha.create().with(AlephaOrmPostgres),
+    );
+  });
+
+  it("strict: fails closed for an org-less user (sqlite)", async () => {
+    await testStrictFailsClosedForOrglessUser(
+      Alepha.create({ env: { DATABASE_URL: "sqlite://:memory:" } }),
+    );
+  });
+  it("strict: fails closed for an org-less user (postgres)", async () => {
+    await testStrictFailsClosedForOrglessUser(
+      Alepha.create().with(AlephaOrmPostgres),
+    );
+  });
+
+  it("strict: refuses insert without a tenant (sqlite)", async () => {
+    await testStrictRefusesInsertWithoutTenant(
+      Alepha.create({ env: { DATABASE_URL: "sqlite://:memory:" } }),
+    );
+  });
+  it("strict: refuses insert without a tenant (postgres)", async () => {
+    await testStrictRefusesInsertWithoutTenant(
+      Alepha.create().with(AlephaOrmPostgres),
+    );
+  });
 });

package/src/orm/__tests__/orm-errors.spec.ts

@@ -1,4 +1,4 @@
-import { Alepha, t } from "alepha";
+import { Alepha, z } from "alepha";
 import { describe, expect, it } from "vitest";
 import {
   $entity,
@@ -34,10 +34,10 @@ describe("Database Error Tests", () => {
   // Parent entity (referenced by child)
   const parents = $entity({
     name: "error_test_parents",
-    schema: t.object({
+    schema: z.object({
       id: db.primaryKey(),
-      name: t.text(),
-      email: t.text(),
+      name: z.text(),
+      email: z.text(),
     }),
     indexes: [{ column: "email", unique: true }],
   });
@@ -45,10 +45,10 @@ describe("Database Error Tests", () => {
   // Child entity (references parent) - using RESTRICT (no cascade) to test FK errors
   const children = $entity({
     name: "error_test_children",
-    schema: t.object({
+    schema: z.object({
       id: db.primaryKey(),
-      parentId: t.integer(), // Plain integer, no db.ref() to avoid cascade
-      name: t.text(),
+      parentId: z.integer(), // Plain integer, no db.ref() to avoid cascade
+      name: z.text(),
     }),
     foreignKeys: [
       {
@@ -61,10 +61,10 @@ describe("Database Error Tests", () => {
   // Entity with required fields for NOT NULL tests
   const requiredFields = $entity({
     name: "error_test_required",
-    schema: t.object({
+    schema: z.object({
       id: db.primaryKey(),
-      requiredName: t.text(), // NOT NULL by default
-      optionalNote: t.optional(t.text()), // Nullable
+      requiredName: z.text(), // NOT NULL by default
+      optionalNote: z.text().optional(), // Nullable
     }),
   });