gemi 0.115.0 → 0.117.0

package/dist/bin/orm/emit.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"emit.d.ts","sourceRoot":"","sources":["../../../bin/orm/emit.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,0BAA0B,CAAC;AAErD,OAAO,EAKL,KAAK,WAAW,EAGjB,MAAM,kBAAkB,CAAC;AAU1B,eAAO,MAAM,eAAe,iDAAkD,CAAC;AAC/E,MAAM,MAAM,aAAa,GAAG,CAAC,OAAO,eAAe,CAAC,CAAC,MAAM,CAAC,CAAC;AAiD7D,qBAAa,sBAAuB,SAAQ,KAAK;gBACnC,OAAO,EAAE,MAAM;CAI5B;AAsUD,wBAAgB,gBAAgB,CAC9B,KAAK,EAAE,IAAI,CAAC,KAAK,EACjB,cAAc,EAAE,GAAG,CAAC,MAAM,EAAE;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,IAAI,CAAC,KAAK,CAAA;CAAE,EAAE,CAAC,EACnE,QAAQ,GAAE,MAAM,EAAO,GACtB,WAAW,CAgCb;AAED,wBAAgB,iBAAiB,CAC/B,MAAM,EAAE,SAAS,IAAI,CAAC,KAAK,EAAE,EAC7B,QAAQ,GAAE,MAAM,EAAO,GACtB,WAAW,EAAE,CAmBf;AAUD,wBAAgB,cAAc,CAAC,OAAO,EAAE,WAAW,EAAE,GAAG,MAAM,CA2B7D;AA2CD,6CAA6C;AAC7C,MAAM,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC,CAAC;AAonBxD,wBAAgB,cAAc,CAC5B,OAAO,EAAE,WAAW,EAAE,EACtB,KAAK,GAAE,OAAY,GAClB,MAAM,CA8ER;AAED,wBAAgB,aAAa,CAAC,OAAO,EAAE,WAAW,EAAE,GAAG,MAAM,CAwB5D;AA+BD;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,aAAa,CAC3B,MAAM,EAAE,SAAS,IAAI,CAAC,KAAK,EAAE,EAC7B,KAAK,GAAE,SAAS,IAAI,CAAC,aAAa,EAAO,EACzC,QAAQ,GAAE,MAAM,EAAO,GACtB,MAAM,CAAC,aAAa,EAAE,MAAM,CAAC,CAO/B"}
+{"version":3,"file":"emit.d.ts","sourceRoot":"","sources":["../../../bin/orm/emit.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,0BAA0B,CAAC;AAErD,OAAO,EAKL,KAAK,WAAW,EAGjB,MAAM,kBAAkB,CAAC;AAU1B,eAAO,MAAM,eAAe,iDAAkD,CAAC;AAC/E,MAAM,MAAM,aAAa,GAAG,CAAC,OAAO,eAAe,CAAC,CAAC,MAAM,CAAC,CAAC;AAiD7D,qBAAa,sBAAuB,SAAQ,KAAK;gBACnC,OAAO,EAAE,MAAM;CAI5B;AAwXD,wBAAgB,gBAAgB,CAC9B,KAAK,EAAE,IAAI,CAAC,KAAK,EACjB,cAAc,EAAE,GAAG,CAAC,MAAM,EAAE;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,IAAI,CAAC,KAAK,CAAA;CAAE,EAAE,CAAC,EACnE,QAAQ,GAAE,MAAM,EAAO,GACtB,WAAW,CAmCb;AA+BD,wBAAgB,iBAAiB,CAC/B,MAAM,EAAE,SAAS,IAAI,CAAC,KAAK,EAAE,EAC7B,QAAQ,GAAE,MAAM,EAAO,GACtB,WAAW,EAAE,CAmBf;AAUD,wBAAgB,cAAc,CAAC,OAAO,EAAE,WAAW,EAAE,GAAG,MAAM,CA2B7D;AA2CD,6CAA6C;AAC7C,MAAM,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC,CAAC;AAonBxD,wBAAgB,cAAc,CAC5B,OAAO,EAAE,WAAW,EAAE,EACtB,KAAK,GAAE,OAAY,GAClB,MAAM,CA8ER;AAED,wBAAgB,aAAa,CAAC,OAAO,EAAE,WAAW,EAAE,GAAG,MAAM,CAwB5D;AA+BD;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,aAAa,CAC3B,MAAM,EAAE,SAAS,IAAI,CAAC,KAAK,EAAE,EAC7B,KAAK,GAAE,SAAS,IAAI,CAAC,aAAa,EAAO,EACzC,QAAQ,GAAE,MAAM,EAAO,GACtB,MAAM,CAAC,aAAa,EAAE,MAAM,CAAC,CAO/B"}

package/dist/bin/orm-generator.js

@@ -1331,7 +1331,10 @@ import { mkdir, writeFile } from "fs/promises";
 import { join } from "path";
 
 // orm/schema.ts
-var SCHEMA_ARTIFACT_VERSION = 2;
+function artifactVersionFor(schemas) {
+  const encrypted = schemas.some((schema) => Object.values(schema.fields).some((field) => field.encrypted === true));
+  return encrypted ? 3 : 2;
+}
 var NANOID_DEFAULT_LENGTH = 21;
 
 // bin/orm/emit.ts
@@ -1439,8 +1442,35 @@ function fieldSchema(model, field, warnings) {
   const def = defaultSpec(model, field, warnings);
   if (def)
     schema.default = def;
+  if (isEncryptedField(field)) {
+    assertEncryptable(model, field);
+    schema.encrypted = true;
+  }
   return schema;
 }
+var ENCRYPTED_ANNOTATION = /(^|\s)@gemi\.encrypted(?![\w.])/;
+function isEncryptedField(field) {
+  return typeof field.documentation === "string" && ENCRYPTED_ANNOTATION.test(field.documentation);
+}
+function assertEncryptable(model, field) {
+  const name = `${model}.${field.name}`;
+  const refuse = (why) => {
+    throw new UnsupportedSchemaError(`gemi ORM: ${name} is marked @gemi.encrypted, but ${why}`);
+  };
+  if (field.kind !== "scalar" || field.type !== "String") {
+    refuse(`only String columns can be encrypted (it is ${field.type}).`);
+  }
+  if (field.isList)
+    refuse("a list column cannot be encrypted.");
+  if (field.isId)
+    refuse("an @id cannot be encrypted: it could never be looked up.");
+  if (field.isUnique) {
+    refuse("an @unique column cannot be encrypted: each write stores a different ciphertext, so the index would never collide.");
+  }
+  if (field.hasDefaultValue) {
+    refuse("a column with @default cannot be encrypted: the default would be stored in plaintext.");
+  }
+}
 function relationSchema(field, joinTable) {
   const relation = {
     name: field.name,
@@ -1510,15 +1540,32 @@ function buildModelSchema(model, byRelationName, warnings = []) {
     fields[field.name] = fieldSchema(model.name, field, warnings);
   }
   const primaryKey = model.primaryKey ? [...model.primaryKey.fields] : model.fields.filter((field) => field.isId).map((field) => field.name);
+  const keys = uniques(model);
+  assertEncryptedNotKeys(model.name, fields, primaryKey, keys, relations);
   return {
     name: model.name,
     table: model.dbName ?? model.name,
     fields,
     primaryKey,
-    uniques: uniques(model),
+    uniques: keys,
     relations
   };
 }
+function assertEncryptedNotKeys(model, fields, primaryKey, keys, relations) {
+  for (const field of Object.values(fields)) {
+    if (field.encrypted !== true)
+      continue;
+    const name = `${model}.${field.name}`;
+    if (primaryKey.includes(field.name) || keys.some((key) => key.includes(field.name))) {
+      throw new UnsupportedSchemaError(`gemi ORM: ${name} is marked @gemi.encrypted, but it is part of a ` + `primary or unique key: each write stores a different ciphertext, ` + `so the key could never match.`);
+    }
+    for (const relation of Object.values(relations)) {
+      if (relation.from.includes(field.name)) {
+        throw new UnsupportedSchemaError(`gemi ORM: ${name} is marked @gemi.encrypted, but it is the foreign ` + `key of ${model}.${relation.name}: a relation cannot join on a ciphertext.`);
+      }
+    }
+  }
+}
 function buildModelSchemas(models, warnings = []) {
   const byRelationName = new Map;
   for (const model of models) {
@@ -1548,7 +1595,7 @@ import type { ModelSchema } from "gemi/orm";
 `,
     `// rather than with a TypeError inside the compiler.
 `,
-    `export const ARTIFACT_VERSION = ${SCHEMA_ARTIFACT_VERSION};
+    `export const ARTIFACT_VERSION = ${artifactVersionFor(schemas)};
 `
   ];
   for (const schema of schemas) {
@@ -2031,5 +2078,5 @@ import_generator_helper.generatorHandler({
   }
 });
 
-//# debugId=CE46959AC907174A64756E2164756E21
+//# debugId=049E59ABB41E57F464756E2164756E21
 //# sourceMappingURL=orm-generator.js.map