objection 3.7.0 → 3.8.0

package/lib/queryBuilder/graph/GraphUpsert.js

@@ -14,16 +14,17 @@ const { RelationExpression } = require('../RelationExpression');
 const { GraphNodeDbExistence } = require('./GraphNodeDbExistence');
 const { GraphData } = require('./GraphData');
 const { uniqBy, asArray, isObject } = require('../../utils/objectUtils');
-const { deprecate } = require('../../utils/deprecate');
+const { warnOnce } = require('../../utils/warnings');
 
 class GraphUpsert {
-  constructor({ rootModelClass, objects, upsertOptions }) {
+  constructor({ rootModelClass, objects, upsertOptions, insertOnly = false }) {
     checkCanBeConvertedToModels(rootModelClass, objects);
     warnOnUnknownOptions(upsertOptions);
 
     this.objects = rootModelClass.ensureModelArray(objects, GraphUpsert.modelOptions);
     this.isArray = Array.isArray(objects);
     this.upsertOpt = upsertOptions;
+    this.insertOnly = insertOnly;
   }
 
   static get modelOptions() {
@@ -39,7 +40,7 @@ class GraphUpsert {
   // TODO: Throw an error instead in objection 4.0.
   static warnOnConflict(builder, method) {
     if (builder.has(isOnConflictOperation)) {
-      deprecate(
+      warnOnce(
         `onConflict(), ignore() and merge() are not supported by ${method}(). ` +
           'Insert the conflicting rows with a separate insert() query instead. ' +
           'This will throw in objection 4.0.',
@@ -49,7 +50,7 @@ class GraphUpsert {
 
   run(builder) {
     const modelClass = builder.modelClass();
-    const graphOptions = new GraphOptions(this.upsertOpt);
+    const graphOptions = new GraphOptions(this.upsertOpt, [], this.insertOnly);
 
     const graph = ModelGraph.create(modelClass, this.objects);
     assignDbRefsAsRelateProps(graph);
@@ -74,7 +75,7 @@ function warnOnUnknownOptions(upsertOptions) {
 
   for (const name of Object.keys(upsertOptions)) {
     if (!OPTION_NAMES.includes(name)) {
-      deprecate(
+      warnOnce(
         `Unknown graph option "${name}" is ignored. ` +
           `Valid options are: ${OPTION_NAMES.join(', ')}. This will throw in objection 4.0.`,
       );
@@ -245,8 +246,10 @@ function checkForErrors(builder) {
     checkForNotFoundErrors(graphData, builder);
     checkForUnallowedRelationErrors(graphData, builder);
     checkForUnallowedReferenceErrors(graphData, builder);
-    checkForUnallowedMarkerErrors(graphData, builder);
+    // Root models can't be marked even with `allowMarkers`, so report that
+    // first instead of pointing to the option.
     checkForRootUnrelateOrDeleteErrors(graphData, builder);
+    checkForUnallowedMarkerErrors(graphData, builder);
 
     if (graphData.graphOptions.isInsertOnly()) {
       checkForHasManyRelateErrors(graphData);
@@ -291,8 +294,7 @@ function checkForNotFoundErrors(graphData, builder) {
   for (const node of graph.nodes) {
     if (
       node.obj.$hasId() &&
-      !node.toBeUnrelated &&
-      !node.toBeDeleted &&
+      !node.toBeUnrelatedOrDeleted &&
       !graphOptions.shouldInsertIgnoreDisable(node, graphData) &&
       !graphOptions.shouldRelateIgnoreDisable(node, graphData) &&
       !currentGraph.nodeForNode(node)
@@ -347,10 +349,12 @@ function checkForUnallowedReferenceErrors(graphData, builder) {
 
 // `#unrelate` and `#delete` markers come from the graph data, which may be
 // untrusted input. Like `#ref`, they have to be allowed explicitly (#2410).
+// An insert has nothing to unrelate or delete, so `insertGraph` rejects them.
 function checkForUnallowedMarkerErrors(graphData, builder) {
   const { graph, graphOptions } = graphData;
+  const isInsertOnly = graphOptions.isInsertOnly();
 
-  if (graphOptions.allowMarkers()) {
+  if (graphOptions.allowMarkers() && !isInsertOnly) {
     return;
   }
 
@@ -361,7 +365,9 @@ function checkForUnallowedMarkerErrors(graphData, builder) {
 
     throw builder.modelClass().createValidationError({
       type: ValidationErrorType.InvalidGraph,
-      message: `${graphUnrelateProp} and ${graphDeleteProp} markers are not allowed in a graph by default. see the allowMarkers insert/upsert graph option`,
+      message: isInsertOnly
+        ? `${graphUnrelateProp} and ${graphDeleteProp} can only be used in upsertGraph, not in insertGraph`
+        : `${graphUnrelateProp} and ${graphDeleteProp} markers are not allowed in a graph by default. see the allowMarkers upsertGraph option`,
     });
   }
 }

package/lib/queryBuilder/join/RelationJoiner.js

@@ -1,7 +1,7 @@
 'use strict';
 
 const { uniqBy } = require('../../utils/objectUtils');
-const { Selection } = require('../operations/select/Selection');
+const { Selection, mapIdentifier } = require('../operations/select/Selection');
 const { SelectOperation } = require('../operations/select/SelectOperation');
 const { createModifier } = require('../../utils/createModifier');
 const { map: mapPromise } = require('../../utils/promiseUtils');
@@ -89,6 +89,13 @@ class RelationJoiner {
     }
   }
 
+  // Whether the joins can return more than one row per root model.
+  hasToManyJoins(builder) {
+    return this._getTableTree(builder).nodes.some(
+      (tableNode) => tableNode.relation && !tableNode.relation.isOneToOne(),
+    );
+  }
+
   parseResult(builder, flatRows) {
     const parser = JoinResultParser.create({
       tableTree: this._getTableTree(builder),
@@ -203,7 +210,60 @@ class RelationJoiner {
       }
     }
 
-    builder.select(selectionsToStrings(selections));
+    // Each name is selected only once, as SQL Server returns duplicate names as
+    // arrays of values, and the other databases silently return one of them.
+    removeRootSelectAll(builder);
+    const tableTree = this._getTableTree(builder);
+    const userSelectionsByName = new Map();
+
+    for (const selection of findJoinSelections(builder)) {
+      // Only the columns of the joined tables are known for `table.*`:
+      const node = isSelectAll(selection) ? tableTree.nodesByAlias.get(selection.table) : null;
+      const names = node
+        ? getAllColumnSelectionsForNode({ builder, tableNode: node }).map((it) => it.column)
+        : [selection.name];
+
+      for (const name of names) {
+        userSelectionsByName.set(mapIdentifier(builder, name), { selection, name });
+      }
+    }
+
+    const idAliases = new Set(
+      tableTree.nodes.flatMap((node) =>
+        getIdSelectionsForNode({ tableNode: node }).map((it) => it.alias),
+      ),
+    );
+
+    builder.select(
+      selectionsToStrings(
+        selections.filter(({ table, column, alias }) => {
+          const { selection, name } = userSelectionsByName.get(mapIdentifier(builder, alias)) || {};
+
+          if (!selection) {
+            return true;
+          } else if (selection.column) {
+            if (!Selection.doesSelect(builder, selection, `${table}.${column}`)) {
+              throw new Error(
+                `withGraphJoined: the selection '${selectionToString(selection)}' selects '${name}', ` +
+                  `the name under which the column '${table}.${column}' is selected. ` +
+                  'Select it under a different name.',
+              );
+            }
+          } else if (idAliases.has(alias)) {
+            // Raws, subqueries and aggregates select values that we can't see
+            // into. They replace our columns, but not the ids that we need to
+            // parse the result.
+            throw new Error(
+              `withGraphJoined: a raw, subquery or aggregate selection selects '${name}', ` +
+                `the name under which the id column '${table}.${column}' is selected. ` +
+                'Select it under a different name, or select the id column itself.',
+            );
+          }
+
+          return false;
+        }),
+      ),
+    );
   }
 }
 
@@ -268,8 +328,9 @@ function ensureIdAndRelationPropsAreSelected({ builder, tableNode }) {
     ),
   ];
 
+  const hasSelectionAs = createHasSelectionAs(builder);
   const selectStrings = uniqBy(cols)
-    .filter((col) => !hasSelectionAs(builder, col))
+    .filter((col) => !hasSelectionAs(col))
     .map((col) => `${tableRef}.${col}`);
 
   return builder.select(selectStrings);
@@ -297,9 +358,10 @@ function getSelectionsForNode({ builder, tableNode, userSelectQueries }) {
     selections = allColumnSelections.concat(selections);
   } else {
     const idSelections = getIdSelectionsForNode({ tableNode });
+    const hasUserSelectionAs = createHasUserSelectionAs(userSelectQuery, tableNode);
 
     for (const idSelection of idSelections) {
-      if (!hasUserSelectionAs(userSelectQuery, tableNode, idSelection.column)) {
+      if (!hasUserSelectionAs(idSelection.column)) {
         selections.push(idSelection);
         internalSelections.push(idSelection);
       }
@@ -334,14 +396,16 @@ function findJoinSelections(builder) {
   return selections;
 }
 
-// Like `builder.hasSelectionAs(column, column)`, but ignoring the columns
-// passed to aggregates, as they don't select them.
-function hasSelectionAs(builder, column) {
+// Create a `(column) => builder.hasSelectionAs(column, column)` function that
+// ignores the columns passed to aggregates, as they don't select them. Clone
+// the builder once, not once per column.
+function createHasSelectionAs(builder) {
   if (builder.has(isAggregateOperation)) {
+    const selectionQuery = builder.clone().clear(isAggregateOperation);
     // Explicit, as a query with only aggregates doesn't select all columns.
-    return builder.clone().clear(isAggregateOperation).hasSelectionAs(column, column, true);
+    return (column) => selectionQuery.hasSelectionAs(column, column, true);
   } else {
-    return builder.hasSelectionAs(column, column);
+    return (column) => builder.hasSelectionAs(column, column);
   }
 }
 
@@ -355,11 +419,12 @@ function findUserSelections(builder, tableNode) {
   }
 }
 
-function hasUserSelectionAs(builder, tableNode, column) {
+function createHasUserSelectionAs(builder, tableNode) {
   if (tableNode.parentNode) {
-    return hasSelectionAs(builder, column);
+    return createHasSelectionAs(builder);
   } else {
-    return builder.hasSelectionAs(column, column);
+    // Qualified, as the root query can also select the columns of the joined tables.
+    return (column) => builder.hasSelectionAs(`${tableNode.alias}.${column}`, column);
   }
 }
 
@@ -416,6 +481,28 @@ function getIdSelectionsForNode({ tableNode }) {
   });
 }
 
+// The selections of all columns of the root table replace the user's `*`, which
+// would select them a second time, and a bare `*` also the columns of the
+// joined tables under the same names.
+function removeRootSelectAll(builder) {
+  const tableRef = builder.tableRef();
+  const isRootSelectAll = (selection) =>
+    selection.column === '*' && (!selection.table || selection.table === tableRef);
+  const isSelect = (op) =>
+    op.constructor === SelectOperation && !isAggregateOperation(op) && !op.isDistinctOn;
+
+  builder.forEachOperation(isSelect, (op) => {
+    op.args = op.args.filter((arg) => {
+      const selection = Selection.create(arg);
+      return !selection || !isRootSelectAll(selection);
+    });
+    op.selections = op.selections.filter((selection) => !isRootSelectAll(selection));
+  });
+
+  // An empty `distinct()` still makes the whole select distinct.
+  builder.clear((op) => isSelect(op) && op.name !== 'distinct' && op.args.length === 0);
+}
+
 function selectionsToStrings(selections) {
   return selections.map((selection) => {
     const selectStr = `${selection.table}.${selection.column}`;
@@ -423,6 +510,11 @@ function selectionsToStrings(selections) {
   });
 }
 
+function selectionToString({ table, column, alias }) {
+  const selection = table ? `${table}.${column}` : column;
+  return alias ? `${selection} as ${alias}` : selection;
+}
+
 function isSelectAll(selection) {
   return selection.column === '*';
 }

package/lib/queryBuilder/join/utils.js

@@ -6,8 +6,8 @@ const { isPostgres, isMySql, isMsSql, isSqlite } = require('../../utils/knexUtil
 const RELATION_RECURSION_LIMIT = 64;
 
 // The maximum length of the column aliases of the joined relations, after
-// which the database would truncate them. Unknown databases use the strictest
-// of the known limits, the one of postgres.
+// which the database would truncate them. Other databases keep the limit of
+// postgres, which isn't the strictest one: Oracle before 12.2 only allows 30.
 function getIdentifierLengthLimit(knex) {
   if (isPostgres(knex)) {
     return 63;

package/lib/queryBuilder/operations/DelegateOperation.js

@@ -55,6 +55,17 @@ class DelegateOperation extends QueryBuilderOperation {
     return this.onBuild !== DelegateOperation.prototype.onBuild || this.delegate.hasOnBuild();
   }
 
+  onAfterBuild(builder) {
+    return this.delegate.onAfterBuild(builder);
+  }
+
+  hasOnAfterBuild() {
+    return (
+      this.onAfterBuild !== DelegateOperation.prototype.onAfterBuild ||
+      this.delegate.hasOnAfterBuild()
+    );
+  }
+
   onBuildKnex(knexBuilder, builder) {
     return this.delegate.onBuildKnex(knexBuilder, builder);
   }
@@ -110,6 +121,17 @@ class DelegateOperation extends QueryBuilderOperation {
     );
   }
 
+  queryBatches(builder) {
+    return this.delegate.queryBatches(builder);
+  }
+
+  hasQueryBatches() {
+    return (
+      this.queryBatches !== DelegateOperation.prototype.queryBatches ||
+      this.delegate.hasQueryBatches()
+    );
+  }
+
   onError(builder, error) {
     return this.delegate.onError(builder, error);
   }

package/lib/queryBuilder/operations/FirstOperation.js

@@ -3,10 +3,12 @@
 const { QueryBuilderOperation } = require('./QueryBuilderOperation');
 
 class FirstOperation extends QueryBuilderOperation {
-  onBuildKnex(knexBuilder, builder) {
-    const modelClass = builder.modelClass();
+  shouldLimit(builder) {
+    return builder.isFind() && builder.modelClass().useLimitInFirst;
+  }
 
-    if (builder.isFind() && modelClass.useLimitInFirst) {
+  onBuildKnex(knexBuilder, builder) {
+    if (this.shouldLimit(builder)) {
       knexBuilder = knexBuilder.limit(1);
     }
 

package/lib/queryBuilder/operations/InsertGraphOperation.js

@@ -42,6 +42,7 @@ class InsertGraphOperation extends DelegateOperation {
         noUnrelate: true,
         insertMissing: true,
       }),
+      insertOnly: true,
     });
 
     // We resolve this query here and will not execute it. This is because the root

package/lib/queryBuilder/operations/InstanceDeleteOperation.js

@@ -3,6 +3,7 @@
 const { DeleteOperation } = require('./DeleteOperation');
 const { InstanceFindOperation } = require('./InstanceFindOperation');
 const { assertHasId } = require('../../utils/assert');
+const { addWhereGroup } = require('../whereGroups');
 
 class InstanceDeleteOperation extends DeleteOperation {
   constructor(name, opt) {
@@ -20,7 +21,7 @@ class InstanceDeleteOperation extends DeleteOperation {
     super.onBuild(builder);
 
     assertHasId(this.instance);
-    builder.findById(this.instance.$id());
+    addWhereGroup(builder, () => builder.findById(this.instance.$id()));
   }
 
   async onAfter2(builder, result) {

package/lib/queryBuilder/operations/InstanceFindOperation.js

@@ -2,6 +2,7 @@
 
 const { FindOperation } = require('./FindOperation');
 const { assertHasId } = require('../../utils/assert');
+const { addWhereGroup } = require('../whereGroups');
 
 class InstanceFindOperation extends FindOperation {
   constructor(name, opt) {
@@ -11,7 +12,7 @@ class InstanceFindOperation extends FindOperation {
 
   onBuild(builder) {
     assertHasId(this.instance);
-    builder.findById(this.instance.$id());
+    addWhereGroup(builder, () => builder.findById(this.instance.$id()));
   }
 }
 

package/lib/queryBuilder/operations/InstanceUpdateOperation.js

@@ -4,6 +4,7 @@ const { UpdateOperation } = require('./UpdateOperation');
 const { InstanceFindOperation } = require('./InstanceFindOperation');
 const { assertHasId } = require('../../utils/assert');
 const { isObject } = require('../../utils/objectUtils');
+const { addWhereGroup } = require('../whereGroups');
 
 class InstanceUpdateOperation extends UpdateOperation {
   constructor(name, opt) {
@@ -27,7 +28,7 @@ class InstanceUpdateOperation extends UpdateOperation {
     super.onBuild(builder);
 
     assertHasId(this.instance);
-    builder.findById(this.instance.$id());
+    addWhereGroup(builder, () => builder.findById(this.instance.$id()));
   }
 
   async onAfter2(builder, result) {

package/lib/queryBuilder/operations/LimitPerParentOperation.js

@@ -0,0 +1,145 @@
+'use strict';
+
+const { QueryBuilderOperation } = require('./QueryBuilderOperation');
+const { RangeOperation } = require('./RangeOperation');
+const { FirstOperation } = require('./FirstOperation');
+const { isString, isNumber } = require('../../utils/objectUtils');
+const { hasWindowFunctions, isKnexRaw } = require('../../utils/knexUtils');
+
+// Without underscores, so that column name mappers don't change it.
+const rowNumberColumn = 'objectiontmprownum';
+
+// Applies the `limit()`, `offset()` and `first()` of a relation query that
+// fetches the related models of many parents to each parent separately.
+class LimitPerParentOperation extends QueryBuilderOperation {
+  constructor(name, opt) {
+    super(name, opt);
+    this.findOperation = opt.findOperation;
+  }
+
+  onBuild(builder) {
+    builder.addInternalSelection(rowNumberColumn);
+  }
+
+  // Return the limit and offset of the query, built into `knexBuilder` by any
+  // of its operations, or `null` if it has none:
+  getRange(knexBuilder, builder) {
+    // `page()` and `range()` keep limiting all parents, as their total does.
+    if (!builder.has(RangeOperation)) {
+      const { limit = null, offset = null } = knexBuilder._single;
+      // `first()` only limits the query with `useLimitInFirst`:
+      const isFirst = builder.has(FirstOperation);
+
+      if (limit !== null || offset !== null || isFirst) {
+        return { limit: isFirst ? 1 : limit, offset: offset ?? 0 };
+      }
+    }
+
+    return null;
+  }
+
+  // Called by `buildKnexQuery()` after the default table and select are set.
+  onAfterBuildKnex(knexBuilder, builder) {
+    const knex = builder.knex();
+    const range = this.getRange(knexBuilder, builder);
+
+    if (!range) {
+      return knexBuilder;
+    } else if (!hasWindowFunctions(knex)) {
+      // `WhereInEagerOperation` fetches the related models of each parent with
+      // a separate query then, so only `first()` still needs to be applied:
+      return range.limit === null ? knexBuilder : knexBuilder.limit(range.limit);
+    } else {
+      const { limit, offset } = range;
+      // Number the rows of each parent one level up, aliased as the related
+      // table, so that the order can refer to the selected columns and their
+      // aliases as in the query itself, e.g. to `id` when a joined table has
+      // an `id` too. The order moves into the window function, as SQL Server
+      // doesn't allow it in subqueries.
+      const numberedQuery = knex
+        .queryBuilder()
+        .select('*')
+        .rowNumber(rowNumberColumn, (window) =>
+          window
+            .orderBy(getWindowOrder(builder, knex))
+            .partitionBy(this.findOperation.ownerKeyColumns()),
+        )
+        .from(
+          knexBuilder
+            .clone()
+            .clear('with')
+            .clear('limit')
+            .clear('offset')
+            .clear('order')
+            .as(builder.tableRef()),
+        );
+
+      // Select the rows in range with the query itself, to keep its settings
+      // like `timeout()`, and its common table expressions.
+      knexBuilder
+        .clear('select')
+        .clear('where')
+        .clear('join')
+        .clear('union')
+        .clear('group')
+        .clear('having')
+        .clear('order')
+        .clear('limit')
+        .clear('offset')
+        .select('*')
+        .from(numberedQuery.as(rowNumberColumn))
+        .where(rowNumberColumn, '>', offset)
+        .orderBy(rowNumberColumn);
+
+      if (limit !== null) {
+        // knex also accepts raw offsets:
+        const end = isNumber(offset) ? offset + limit : knex.raw('? + ?', [offset, limit]);
+        knexBuilder.where(rowNumberColumn, '<=', end);
+      }
+
+      return knexBuilder;
+    }
+  }
+}
+
+// Convert the `orderBy()` and `orderByRaw()` calls of the query to the order
+// of knex's window functions.
+function getWindowOrder(builder, knex) {
+  const order = [];
+
+  builder.forEachOperation(builder.constructor.OrderBySelector, (op) => {
+    const args = op.getKnexArgs(builder);
+
+    if (op.name === 'orderByRaw') {
+      const [sql, bindings] = args;
+      order.push({ column: isKnexRaw(sql) ? sql : knex.raw(sql, bindings) });
+    } else {
+      const [column, direction, nulls] = args;
+      const items = Array.isArray(column)
+        ? column.map((item) => (isString(item) ? { column: item } : item))
+        : [{ column, order: direction, nulls }];
+
+      for (const item of items) {
+        if (item.nulls) {
+          // Not all databases support `nulls first` and `nulls last`:
+          order.push({
+            column: knex.raw('(case when ? is null then 0 else 1 end)', [
+              isString(item.column) ? knex.ref(item.column) : item.column,
+            ]),
+            order: item.nulls === 'first' ? 'asc' : 'desc',
+          });
+        }
+
+        // Unlike in `orderBy()`, knex adds the direction to the window as it is:
+        order.push({ column: item.column, order: /^desc$/i.test(item.order) ? 'desc' : 'asc' });
+      }
+    }
+  });
+
+  // SQL Server requires an order in the window function:
+  return order.length ? order : [{ column: knex.raw('(select null)') }];
+}
+
+module.exports = {
+  LimitPerParentOperation,
+};

package/lib/queryBuilder/operations/QueryBuilderOperation.js

@@ -6,9 +6,11 @@ const hookNameToHasMethodName = {
   onBefore2: 'hasOnBefore2',
   onBefore3: 'hasOnBefore3',
   onBuild: 'hasOnBuild',
+  onAfterBuild: 'hasOnAfterBuild',
   onBuildKnex: 'hasOnBuildKnex',
   onRawResult: 'hasOnRawResult',
   queryExecutor: 'hasQueryExecutor',
+  queryBatches: 'hasQueryBatches',
   onAfter1: 'hasOnAfter1',
   onAfter2: 'hasOnAfter2',
   onAfter3: 'hasOnAfter3',
@@ -107,6 +109,20 @@ class QueryBuilderOperation {
     return this.onBuild !== QueryBuilderOperation.prototype.onBuild;
   }
 
+  // This is called after `onBuild` when the query is executed, right before the
+  // knex query is built and executed, but not when the query is only built,
+  // e.g. with `toKnexQuery()` or `resultSize()`. Use it for work that needs the
+  // built query, like queries that have to run before it. It's also called for
+  // queries that are resolved or rejected without executing, e.g. with `none()`
+  // or `resolve()`, so check `builder.isExplicitlyResolvedOrRejected()` first.
+  //
+  // This method can be asynchronous.
+  // This method should never call any methods that add operations to the builder.
+  onAfterBuild(builder) {}
+  hasOnAfterBuild() {
+    return this.onAfterBuild !== QueryBuilderOperation.prototype.onAfterBuild;
+  }
+
   // This is called when the knex query is built. Here you should only call knex
   // methods. You may call getters and other immutable methods of the `builder`
   // but you should never call methods that add QueryBuilderOperations.
@@ -177,6 +193,21 @@ class QueryBuilderOperation {
     return this.queryExecutor !== QueryBuilderOperation.prototype.queryExecutor;
   }
 
+  // This is called after `onAfterBuild` when the query is executed. It can
+  // return an array of batches to build and execute the knex query once per
+  // batch, e.g. when a filter has more values than the database accepts in one
+  // statement. The batch being built is in `builder._queryBatch`, and the
+  // results of all batches are merged before `onRawResult` is called. Return
+  // null to execute the query once.
+  //
+  // This method must be synchronous.
+  queryBatches(builder) {
+    return null;
+  }
+  hasQueryBatches() {
+    return this.queryBatches !== QueryBuilderOperation.prototype.queryBatches;
+  }
+
   // This is called if an error occurs in the query execution.
   //
   // This method must return a QueryBuilder instance.

package/lib/queryBuilder/operations/UpdateAndFetchOperation.js

@@ -3,6 +3,7 @@
 const { DelegateOperation } = require('./DelegateOperation');
 const { FindByIdOperation } = require('./FindByIdOperation');
 const { UpdateOperation } = require('./UpdateOperation');
+const { addWhereGroup, assignWhereGroup } = require('../whereGroups');
 
 class UpdateAndFetchOperation extends DelegateOperation {
   constructor(name, opt) {
@@ -41,7 +42,7 @@ class UpdateAndFetchOperation extends DelegateOperation {
 
   onBuild(builder) {
     if (!this.skipIdWhere) {
-      builder.findById(this.id);
+      addWhereGroup(builder, () => builder.findById(this.id));
     }
 
     super.onBuild(builder);
@@ -78,10 +79,17 @@ class UpdateAndFetchOperation extends DelegateOperation {
     return fetched ? this.model : undefined;
   }
 
-  toFindOperation() {
-    return new FindByIdOperation('findById', {
-      id: this.id,
-    });
+  toFindOperation(builder) {
+    // The find operation of the delegate keeps its filters, e.g. the ones that
+    // many-to-many updates move to a subquery when the query is built.
+    const delegate = this.delegate.toFindOperation(builder);
+
+    // Keep the id condition in its own where group, like `onBuild()` does. The
+    // delegate isn't named `findById`, as that would put all the wheres that it
+    // adds in the user's group.
+    return delegate
+      ? new FindByIdDelegateOperation('find', { delegate, id: this.id })
+      : assignWhereGroup(new FindByIdOperation('findById', { id: this.id }));
   }
 
   clone() {
@@ -94,6 +102,15 @@ class UpdateAndFetchOperation extends DelegateOperation {
   }
 }
 
+// Finds the rows of a delegate find operation by id, like `UpdateAndFetchOperation`
+// updates them.
+class FindByIdDelegateOperation extends DelegateOperation {
+  onBuild(builder) {
+    super.onBuild(builder);
+    addWhereGroup(builder, () => builder.findById(this.opt.id));
+  }
+}
+
 module.exports = {
   UpdateAndFetchOperation,
 };