grafeo-ogm 2.4.8 → 2.5.1

package/dist/esm/compilers/mutation.compiler.js

@@ -20,7 +20,15 @@ const MAX_NESTED_LINK_DEPTH = 5;
  * bound as `targetVar`: that node becomes the source, everything in scope
  * stays carried, and its own names are prefixed by it.
  */
-function nestedScope(carryVars, targetVar, depth) {
+function nestedScope(carryVars, targetVar, depth, 
+/**
+ * A token unique along the whole write path (v2.5.1). Pre-2.5.1 the
+ * prefix was `targetVar` alone, which sibling connects share (`target`)
+ * and which per-member union / interface dispatch restarts (`n_conn0`),
+ * so their nested params collided and the last writer won: links went
+ * to the wrong node and edge values were overwritten.
+ */
+uniqueToken) {
     if (depth >= MAX_NESTED_LINK_DEPTH)
         throw new OGMError(`Nested connect / disconnect deeper than ${MAX_NESTED_LINK_DEPTH} levels is not supported.`);
     const vars = [...new Set([...carryVars, targetVar])];
@@ -28,7 +36,7 @@ function nestedScope(carryVars, targetVar, depth) {
         sourceVar: targetVar,
         carryVars: vars,
         withClause: `WITH ${vars.join(', ')}`,
-        varPrefix: `${targetVar}_`,
+        varPrefix: `${uniqueToken}_`,
         depth: depth + 1,
     };
 }
@@ -168,6 +176,9 @@ export class MutationCompiler {
      */
     isConnectFastPathEligible(items, targetNodeDef) {
         for (const item of items) {
+            // A non-object item takes the per-item path, which rejects it.
+            if (!isPlainObject(item))
+                return false;
             // A nested `connect` is per item (v2.4.8): the UNWIND cannot run it.
             if (item.connect != null)
                 return false;
@@ -276,8 +287,10 @@ export class MutationCompiler {
             const input = inputs[i];
             const prefix = `create${i}`;
             const nodeVar = i === 0 ? 'n' : `n_${i}`;
-            const { propString, propParams } = this.buildCreateProperties(input, nodeDef, prefix);
+            // Labels first: an unsafe label must fail as such, before any
+            // input-key check (v2.5.0 rejects unknown keys).
             const labelStr = this.getCachedLabelString(nodeDef);
+            const { propString, propParams } = this.buildCreateProperties(input, nodeDef, prefix);
             lines.push(`CREATE (${nodeVar}:${labelStr} { ${propString} })`);
             mergeParams(params, propParams);
             createdVars.push(nodeVar);
@@ -352,6 +365,7 @@ export class MutationCompiler {
                 if (value === undefined)
                     continue;
                 assertSafePropertyName(key, 'update property');
+                assertKnownField(nodeDef, key, 'update');
                 const propDef = nodeDef.properties.get(key);
                 const paramName = `update_${key}`;
                 const valueExpr = wrapWriteExpr(`$${paramName}`, value, propDef);
@@ -480,6 +494,11 @@ export class MutationCompiler {
                 schema: this.schema,
             });
             const conditions = [
+                // v2.5.1 — an interface / union target binds no label in the
+                // pattern, so restrict the match to its member types. Without it a
+                // nested or cascade delete also DETACH DELETEd any other node on the
+                // same relationship type (a Toy deleted through `pets`).
+                this.targetMatch(targetNodeDef, targetVar).labelPredicate,
                 this.compileTargetWhere(item.where, targetVar, targetNodeDef, args.params, args.policyContext, args.paramCounter),
                 this.buildTargetPolicyPredicate(targetNodeDef, targetVar, args.params, args.policyContext, args.paramCounter, 'delete'),
             ].filter((c) => Boolean(c));
@@ -503,19 +522,31 @@ export class MutationCompiler {
         const labelStr = this.getCachedLabelString(nodeDef);
         const lines = [];
         const params = {};
-        // Build MERGE key properties from where clause (scalar only)
+        // MERGE key: the `@id` / `@unique` fields of `where`, and nothing else
+        // (v2.5.0). Any other key throws:
+        //   - a plain field (`{ email, name }`) became part of the MERGE
+        //     pattern, so an existing node with that email but another name did
+        //     not match — MERGE created a DUPLICATE beside it;
+        //   - an operator key (`name_CONTAINS`) was dropped, silently widening
+        //     the match to the remaining keys;
+        //   - a typo (`usernme`) became a phantom property on the new node.
+        // Pre-1.7.4 any key set was accepted; 1.7.4 required at least one
+        // unique key but still let the others through.
         const mergeProps = [];
         const mergeKeyNames = [];
         for (const [key, value] of Object.entries(where)) {
-            if (value === undefined || value === null)
-                continue;
-            // Skip relationship suffixes and operators
-            if (key === 'AND' || key === 'OR' || key === 'NOT')
-                continue;
-            if (key.includes('_') && !nodeDef.properties.has(key))
+            if (value === undefined)
                 continue;
-            assertSafePropertyName(key, 'merge key');
             const propDef = nodeDef.properties.get(key);
+            if (!propDef ||
+                propDef.isCypher ||
+                !(propDef.isUnique || propDef.isGenerated))
+                throw new OGMError(`upsert "where" accepts only @id / @unique fields of ${nodeDef.typeName}; "${key}" is not one. ` +
+                    `MERGE matches on exactly these keys — put other fields in "create" / "update", ` +
+                    `or use findFirst() + create() / update() for a non-unique match.`);
+            if (value === null)
+                throw new OGMError(`upsert "where.${key}" is null; a MERGE key must have a value.`);
+            assertSafePropertyName(key, 'merge key');
             const paramName = `merge_${key}`;
             const valueExpr = wrapWriteExpr(`$${paramName}`, value, propDef);
             mergeProps.push(`${escapeIdentifier(key)}: ${valueExpr}`);
@@ -523,30 +554,8 @@ export class MutationCompiler {
             params[paramName] = coerceWriteValue(value, propDef);
         }
         if (mergeProps.length === 0)
-            throw new OGMError('upsert requires at least one scalar property in "where" for MERGE key');
-        // Validate that the MERGE key set contains at least one `@unique` or
-        // `@id` property. Pre-1.7.4 we accepted any key set, so:
-        //   - A typo in `where` (e.g. `usernme`) became a phantom MERGE
-        //     property — Neo4j happily created a node with that mis-named
-        //     attribute on first use.
-        //   - A non-unique `where` (e.g. `where: { country: 'AR' }`) matched
-        //     multiple existing nodes; MERGE then fans out across all of
-        //     them, applying ON MATCH SET to every match. Almost always a
-        //     bug, never the developer's intent.
-        // Requiring at least one unique/id key forces MERGE to target at
-        // most one row.
-        const hasUniqueOrId = mergeKeyNames.some((name) => {
-            const prop = nodeDef.properties.get(name);
-            // `isGenerated` is the parser's flag for the `@id` directive;
-            // `isUnique` is the flag for `@unique`. Either is sufficient
-            // to guarantee the MERGE pattern targets at most one row.
-            return prop !== undefined && (prop.isUnique || prop.isGenerated);
-        });
-        if (!hasUniqueOrId)
-            throw new OGMError(`upsert "where" must contain at least one property marked with @id or @unique. ` +
-                `Got [${mergeKeyNames.map((n) => `"${n}"`).join(', ')}] — none of these are unique on ${nodeDef.typeName}. ` +
-                `Without a unique key, MERGE can fan out across multiple existing nodes (applying ON MATCH SET to each) ` +
-                `or create phantom properties on typo. If you really want a non-unique merge, use create() + update().`);
+            throw new OGMError(`upsert requires at least one scalar property in "where" for MERGE key: ` +
+                `an @id or @unique field of ${nodeDef.typeName}.`);
         lines.push(`MERGE (n:${labelStr} { ${mergeProps.join(', ')} })`);
         // ON CREATE SET — all properties from create input (scalar only)
         const createSets = [];
@@ -559,6 +568,7 @@ export class MutationCompiler {
                 throw upsertRelationshipError(nodeDef, key, 'create');
             }
             assertSafePropertyName(key, 'create property');
+            assertKnownField(nodeDef, key, 'create');
             const propDef = nodeDef.properties.get(key);
             const paramName = `onCreate_${key}`;
             const valueExpr = wrapWriteExpr(`$${paramName}`, value, propDef);
@@ -609,6 +619,7 @@ export class MutationCompiler {
                 throw upsertRelationshipError(nodeDef, key, 'update');
             }
             assertSafePropertyName(key, 'update property');
+            assertKnownField(nodeDef, key, 'update');
             const propDef = nodeDef.properties.get(key);
             const paramName = `onMatch_${key}`;
             const valueExpr = wrapWriteExpr(`$${paramName}`, value, propDef);
@@ -682,16 +693,13 @@ export class MutationCompiler {
             for (const key of Object.keys(item)) {
                 if (item[key] === undefined || scalarKeys.includes(key))
                     continue;
-                if (nodeDef.relationships.has(key)) {
-                    // Only the first item's relationship fields have ever been
-                    // rejected; in later items they were (and still are) skipped
-                    // unwritten. Rejecting them everywhere would make calls that
-                    // succeed today throw — tracked as a separate, breaking change.
-                    if (index > 0)
-                        continue;
-                    throw new OGMError(`createMany does not support relationship fields. Found: "${key}". Use create() for nested operations.`);
-                }
+                // v2.5.0 — rejected in EVERY item. Pre-2.5.0 only the first item's
+                // relationship fields were; in later items the nested input was
+                // skipped unwritten.
+                if (nodeDef.relationships.has(key))
+                    throw new OGMError(`createMany does not support relationship fields. Found: "${key}" in data[${index}]. Use create() for nested operations.`);
                 assertSafePropertyName(key, 'createMany property');
+                assertKnownField(nodeDef, key, 'createMany');
                 scalarKeys.push(key);
             }
         // Identify @id (generated) fields that are NOT provided in data
@@ -823,6 +831,7 @@ export class MutationCompiler {
             if (value === undefined)
                 continue;
             assertSafePropertyName(key, 'create property');
+            assertKnownField(nodeDef, key, 'create');
             const propDef = nodeDef.properties.get(key);
             const paramName = `${prefix}_${key}`;
             const valueExpr = wrapWriteExpr(`$${paramName}`, value, propDef);
@@ -1022,6 +1031,11 @@ export class MutationCompiler {
             const relDef = nodeDef.relationships.get(fieldName);
             if (!relDef)
                 continue;
+            // v2.5.1 — `{ rel: null }` (the generated input is `InputMaybe`)
+            // connects nothing. Since 2.4.8 it reached the item compiler with no
+            // `where`, so the MATCH had no filter and EVERY target was linked.
+            if (spec == null)
+                continue;
             const abstract = abstractTarget(relDef.target, this.schema);
             const memberEntries = abstract && !isBlanketSpec(spec)
                 ? perMemberEntries(spec, abstract, fieldName)
@@ -1193,9 +1207,14 @@ export class MutationCompiler {
      */
     buildConnectItem(a) {
         const { connectSpec, relDef, targetNodeDef, sourceVar, connectVar } = a;
+        // v2.5.1 — every connect item reaches here (top-level, array, nested in
+        // create / update / connect). A null or non-object item has no filter:
+        // compiling it would MATCH, and link, every target node.
+        if (!isPlainObject(connectSpec))
+            throw new OGMError(`A connect item on "${relDef.fieldName}" must be an object such as { where: { node: { … } } }; got ${connectSpec === null ? 'null' : typeof connectSpec}.`);
         const lines = [];
-        const whereSpec = connectSpec?.where;
-        const edgeInput = connectSpec?.edge;
+        const whereSpec = connectSpec.where;
+        const edgeInput = connectSpec.edge;
         lines.push(a.withClause);
         lines.push('CALL {');
         lines.push(a.withClause);
@@ -1241,12 +1260,12 @@ export class MutationCompiler {
         // A `connect` nested in the item links the CONNECTED node onward
         // (`connect: { posts: [{ where, connect: { tags: [...] } }] }`), with
         // the same policy predicates at its level. Pre-2.4.8 it was ignored.
-        const nested = connectSpec?.connect;
+        const nested = connectSpec.connect;
         if (nested != null) {
             if (abstractTarget(targetNodeDef.typeName, this.schema))
                 throw new OGMError(`A nested "connect" inside a connect on "${relDef.fieldName}" (abstract type "${targetNodeDef.typeName}") ` +
                     `must be keyed by the implementing type, e.g. { ${relDef.fieldName}: { Member: [{ where, connect }] } }.`);
-            const inner = nestedScope(a.scope.carryVars, connectVar, a.scope.depth);
+            const inner = nestedScope(a.scope.carryVars, connectVar, a.scope.depth, a.edgeParamPrefix);
             for (const nestedConnect of Array.isArray(nested) ? nested : [nested]) {
                 if (!isPlainObject(nestedConnect))
                     throw new OGMError(`A nested "connect" inside a connect on "${relDef.fieldName}" must be an object keyed by relationship.`);
@@ -1289,13 +1308,15 @@ export class MutationCompiler {
      * { tags: [...] } }] }`), with the same policy predicates at its level.
      * Pre-2.4.8 it was ignored. `''`-free: no input, no lines.
      */
-    buildNestedDisconnect(nested, relDef, targetNodeDef, targetVar, carryVars, params, policyContext, paramCounter, depth = 0) {
+    buildNestedDisconnect(nested, relDef, targetNodeDef, targetVar, carryVars, params, policyContext, paramCounter, depth = 0, 
+    /** Unique along the write path; see `nestedScope`. */
+    uniqueToken = targetVar) {
         if (nested == null)
             return [];
         if (abstractTarget(targetNodeDef.typeName, this.schema))
             throw new OGMError(`A nested "disconnect" inside a disconnect on "${relDef.fieldName}" (abstract type "${targetNodeDef.typeName}") ` +
                 `must be keyed by the implementing type, e.g. { ${relDef.fieldName}: { Member: [{ where, disconnect }] } }.`);
-        const inner = nestedScope(carryVars, targetVar, depth);
+        const inner = nestedScope(carryVars, targetVar, depth, uniqueToken);
         const lines = [];
         for (const nestedDisconnect of Array.isArray(nested) ? nested : [nested]) {
             if (!isPlainObject(nestedDisconnect))
@@ -1537,7 +1558,10 @@ export class MutationCompiler {
                             if (nestedDiscConditions.length > 0)
                                 lines.push(`WHERE ${nestedDiscConditions.join(' AND ')}`);
                             lines.push(`DELETE ${relVar}`);
-                            lines.push(...this.buildNestedDisconnect(nestedDisconnect, relDef, targetNodeDef, discTarget, allVars, params, policyContext, paramCounter));
+                            lines.push(...this.buildNestedDisconnect(nestedDisconnect, relDef, targetNodeDef, discTarget, allVars, params, policyContext, paramCounter, 0, 
+                            // `discTarget` restarts per member under union dispatch;
+                            // `itemPrefix` is unique along the path.
+                            `${itemPrefix}_disc${di}`));
                         }
                         lines.push(`RETURN count(*) AS _${relVar}`);
                         lines.push('}');
@@ -1667,6 +1691,7 @@ export class MutationCompiler {
                         if (val === undefined)
                             continue;
                         assertSafePropertyName(prop, 'nested update property');
+                        assertKnownField(targetNodeDef, prop, 'nested update');
                         const nodePropDef = targetNodeDef.properties.get(prop);
                         const paramName = `${itemPrefix}_set_${prop}`;
                         setClauses.push(`${updateVar}.${escapeIdentifier(prop)} = ${wrapWriteExpr(`$${paramName}`, val, nodePropDef)}`);
@@ -1723,6 +1748,10 @@ export class MutationCompiler {
                         // `update` policy, exactly like a direct update on that type
                         // (pre-2.3.0 it enforced no target policy at all).
                         const updateConditions = [
+                            // v2.5.1 — restrict an interface / union target to its member
+                            // types; without it the nested update also SET properties on
+                            // other nodes on the same relationship type.
+                            this.targetMatch(targetNodeDef, updateVar).labelPredicate,
                             this.compileTargetWhere(updateWhere, updateVar, targetNodeDef, params, policyContext, paramCounter),
                             this.buildTargetPolicyPredicate(targetNodeDef, updateVar, params, policyContext, paramCounter, 'update'),
                         ].filter((c) => Boolean(c));
@@ -1969,6 +1998,18 @@ export function unwrapAbstractCreateNode(nodeSpec, target, fieldName) {
             `e.g. { node: { ${target.members[0] ?? 'Member'}: { … } } }. Allowed: ${target.members.map((m) => `"${m}"`).join(', ')}.`);
     return [keys[0], nodeSpec[keys[0]]];
 }
+/**
+ * Reject a write key that is neither a property nor a relationship of the
+ * type (v2.5.0). Pre-2.5.0 only its spelling was checked, so a typo
+ * (`nmae`) was stored as a stray property and the intended field was left
+ * untouched — at every depth (nested creates and updates included).
+ */
+function assertKnownField(nodeDef, key, input) {
+    if (nodeDef.properties.has(key) || nodeDef.relationships.has(key))
+        return;
+    throw new OGMError(`Unknown field "${key}" in the ${input} input of ${nodeDef.typeName}: it is neither a property nor a ` +
+        `relationship of the type. Declare it in the schema, or fix the key.`);
+}
 /**
  * MERGE writes scalars only. Pre-2.4.8 a relationship field in an upsert's
  * `create` / `update` was skipped, so its nested connect / create never