prisma-generator-express 1.14.0 → 1.14.2

package/README.md

@@ -10,7 +10,7 @@ This tool helps you quickly create API endpoints in your Express app using your
 
 When you run `npx prisma generate`, it automatically creates two things:
 
-- Service functions that you can import into your Express routes. By default these functions handle CRUD operations and output validation. This behavior can be controlled.
+- Service functions that you can import into your Express routes. By default, these functions handle CRUD operations and output validation. This behavior can be controlled.
 - Router generator function that lets you select which routes to add to the application and which middlewares to apply.
 
 ## Table of Contents
@@ -19,7 +19,7 @@ When you run `npx prisma generate`, it automatically creates two things:
 - [Basic Usage](#basic-usage)
 - [Router Generator Usage](#router-generator-usage)
 - [Request Object Properties](#request-object-properties)
-- [Roadmap](#roadmap)
+- [Router Schema](#router-schema)
 
 # Installation
 
@@ -72,7 +72,7 @@ app.use((req, res, next) => {
 - Here’s how you can use a generated function in your Express app:
 
 ```ts
-import { UserFindUnique } from './generated/UserFindUnique' // Adjust the path as necessary
+import { UserFindUnique } from './generated/api/UserFindUnique' // Adjust the path as necessary
 import { FindUniqueUserSchema } from './prisma-zod-generator/schemas/FindUniqueUser.schema' // Adjust the path as necessary
 import { FindUniqueUserSchemaOutput } from './prisma-zod-generator/schemas/FindUniqueUserOutput.schema' // Adjust the path as necessary
 
@@ -133,7 +133,7 @@ const addPrisma: RequestHandler = (
   next: NextFunction,
 ) => {
   req.prisma = prisma
-  // req.omitOutputValidation = true (not required if you use `select` instead of `include`)
+  // req.omitOutputValidation = true (output validation is not required if you use `select` instead of `include`)
   next()
 }
 
@@ -164,19 +164,19 @@ const afterFindFirst: RequestHandler = (
 
 /**
  * For generated route the middleware order will be as follows:
- * 1. Query parser
+ * 1. Query parser (kicks in for GET requests)
  * 2. Custom middlewares: config.{method}.before[]
- * 3. Input validator middleware (Optional): config.{method}.input
+ * 3. Input validator middleware (Optional): config.{method}.input. For GET request validates `req.query`, for others - `req.body`
  * 4. Generated middleware
  * 5. Output validator middleware: config.{method}.input
  * 6. Custom middlewares: config.{method}.after[] (not available if req.passToNext is falsy)
  */
-const someRouterConfig: RouteConfig<RequestHandler> = {
+const userAccounRouterConfig: RouteConfig<RequestHandler> = {
   FindFirst: {
     before: [beforeFindFirst],
     after: [afterFindFirst],
     input: {
-      schema: UserAccountFindFirstSchema,
+      schema: UserAccountFindFirstSchema, // make sure you set `isGenerateSelect = true` in prisma-zod-generator
       allow: [
         'select.id',
         'select.full_name',
@@ -194,7 +194,7 @@ const someRouterConfig: RouteConfig<RequestHandler> = {
 }
 
 app.use(addPrisma)
-app.use(UserAccountRouter(someRouterConfig))
+app.use(UserAccountRouter(userAccounRouterConfig))
 
 app.listen(3000, () => {
   console.log('Server is running on http://localhost:3000')
@@ -208,9 +208,8 @@ The following properties can be attached to the `req` object to control the beha
 | Property               | Type         | Description                                                                                                                                                                        |
 | ---------------------- | ------------ | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
 | `prisma`               | PrismaClient | An instance of PrismaClient that allows the middleware to interact with your database.                                                                                             |
-| `passToNext`           | boolean      | Optional, if `true` - the result of a Prisma request will be passed to a next middleware as `if (req.locals) req.locals.data`                                                      |
-| `query`                | Object       | A structured object that conforms to Prisma's API for the selected method.                                                                                                         |
-| `outputValidation`     | ZodTypeAny   | (Optional) A Zod schema used to validate the data returned from the Prisma query before sending it to the client. This helps ensure the response adheres to expected data formats. |
+| `passToNext`           | boolean      | Optional, if `true` - the result of a Prisma request will be passed to the next middleware as `if (req.locals) req.locals.data`                                                      |
+| `outputValidation`     | ZodTypeAny   | (Optional) A Zod schema used to validate the data returned from the Prisma query before sending it to the client. |
 | `omitOutputValidation` | Boolean      | (Optional) A flag that, if set to `true`, disables output validation even if a Zod schema is provided.                                                                             |
 
 ## Router Schema
@@ -219,7 +218,10 @@ The following properties can be attached to the `req` object to control the beha
 | ------------ | -------- | ------------ |
 | `findUnique` | `GET`    | `/:id`       |
 | `findFirst`  | `GET`    | `/first`     |
-| `FindFirst`  | `GET`    | `/`          |
+| `findMany`   | `GET`    | `/`          |
+| `aggregate`  | `GET`    | `/aggregate` |
+| `count`      | `GET`    | `/count`     |
+| `groupBy`    | `GET`    | `/groupby`   |
 | `create`     | `POST`   | `/`          |
 | `createMany` | `POST`   | `/many`      |
 | `update`     | `PUT`    | `/`          |
@@ -227,9 +229,7 @@ The following properties can be attached to the `req` object to control the beha
 | `upsert`     | `PATCH`  | `/`          |
 | `delete`     | `DELETE` | `/`          |
 | `deleteMany` | `DELETE` | `/many`      |
-| `aggregate`  | `GET`    | `/aggregate` |
-| `count`      | `GET`    | `/count`     |
-| `groupBy`    | `GET`    | `/groupby`   |
+
 
 ## Helper functions
 
@@ -248,7 +248,7 @@ interface ValidatorOptions {
 
 ### encodeQueryParams(params: Params)
 
-Can be used on frontend to encode Prisma compatible queries. Alternatively `qs` can be used, but it probably won't work with `OR: [{ blah: false }, { blah: null }]` or some other edge cases.
+It can be used on the frontend to encode Prisma-compatible queries. Alternatively `qs` can be used, but it probably won't work with `OR: [{ blah: false }, { blah: null }]` or some other edge cases.
 
 ```ts
 type RecursiveUrlParams = {

package/dist/helpers/generateRouteFile.js

@@ -27,7 +27,7 @@ import { ${modelName}GroupBy } from './${modelName}GroupBy';
 import { createValidatorMiddleware, ValidatorOptions } from '../createValidatorMiddleware'
 import { createOutputValidatorMiddleware } from '../createOutputValidatorMiddleware'
 import { RouteConfig, ValidatorConfig } from '../routeConfig'
-import { parseQueryParams } from "../ParseQueryParams";
+import { parseQueryParams } from "../parseQueryParams";
 
 const defaultBeforeAfter = {
   before: [] as RequestHandler[],

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "prisma-generator-express",
   "description": "Prisma generator of Express CRUD API",
-  "version": "1.14.0",
+  "version": "1.14.2",
   "main": "dist/generator.js",
   "license": "MIT",
   "bin": {
@@ -35,12 +35,12 @@
     "@types/express": "^4.17.21",
     "@types/jest": "29.5.12",
     "@types/lodash": "^4.17.4",
-    "@types/node": "20.12.12",
+    "@types/node": "20.12.13",
     "@types/prettier": "3.0.0",
     "jest": "29.7.0",
     "prisma": "5.14.0",
     "semantic-release": "^23.1.1",
-    "ts-jest": "29.1.3",
+    "ts-jest": "29.1.4",
     "typescript": "5.4.5"
   },
   "homepage": "https://github.com/multipliedtwice/prisma-generator-express/blob/master/README.md",

package/src/copy/transformZod.spec.ts

@@ -553,106 +553,7 @@ describe('Cryptocurrency Schema Validation', () => {
       expect(error).toBeInstanceOf(ZodError)
     }
   })
-
-  it('deep nesting', () => {
-    const taskSchema = z.object({
-      select: z
-        .object({
-          id: z.boolean().optional(),
-          project_id: z.boolean().optional(),
-          list_id: z.boolean().optional(),
-          user_assignments: z
-            .object({
-              select: z.object({
-                user: z.boolean().optional(),
-              }),
-            })
-            .optional(),
-          tags_mappings: z
-            .object({
-              select: z.object({
-                tag: z.boolean().optional(),
-              }),
-            })
-            .optional(),
-          attachments: z
-            .object({
-              select: z.object({
-                attachment: z.boolean().optional(),
-              }),
-              where: z
-                .object({
-                  is_image: z.boolean().optional(),
-                })
-                .optional(),
-              take: z.number().optional(),
-              orderBy: z
-                .object({
-                  created_at: z.enum(['asc', 'desc']).optional(),
-                })
-                .optional(),
-            })
-            .optional(),
-          rendered_description: z.boolean().optional(),
-          description: z.boolean().optional(),
-          created_at: z.boolean().optional(),
-          start_date: z.boolean().optional(),
-          reactions: z.boolean().optional(),
-          intervals: z.boolean().optional(),
-          column_id: z.boolean().optional(),
-          priority: z.boolean().optional(),
-          due_date: z.boolean().optional(),
-          column: z.boolean().optional(),
-          title: z.boolean().optional(),
-          order: z.boolean().optional(),
-          color: z.boolean().optional(),
-        })
-        .optional(),
-      where: z
-        .object({
-          id: z.string().optional(),
-          AND: z
-            .array(
-              z.object({
-                OR: z
-                  .array(
-                    z.object({
-                      to_delete: z.boolean().nullable().optional(),
-                    }),
-                  )
-                  .optional(),
-              }),
-            )
-            .optional(),
-        })
-        .optional(),
-    })
-
-    const allowedFields = [
-      'select.id',
-      'select.project_id',
-      'select.list_id',
-      'select.user_assignments.select.user',
-      'select.tags_mappings.select.tag',
-      'select.attachments.select.attachment',
-      'select.attachments.where.is_image',
-      'select.attachments.take',
-      'select.attachments.orderBy.created_at',
-      'select.rendered_description',
-      'select.description',
-      'select.created_at',
-      'select.start_date',
-      'select.reactions',
-      'select.intervals',
-      'select.column_id',
-      'select.priority',
-      'select.due_date',
-      'select.column',
-      'select.order',
-      'select.color',
-      'where.id',
-      'where.AND[].OR[].to_delete',
-    ]
+  describe('Prisma example', () => {
     const inputData = {
       select: {
         id: true,
@@ -703,12 +604,160 @@ describe('Cryptocurrency Schema Validation', () => {
         ],
       },
     }
+    it('deep nesting', () => {
+      const taskSchema = z.object({
+        select: z
+          .object({
+            id: z.boolean().optional(),
+            project_id: z.boolean().optional(),
+            list_id: z.boolean().optional(),
+            user_assignments: z
+              .object({
+                select: z.object({
+                  user: z.boolean().optional(),
+                }),
+              })
+              .optional(),
+            tags_mappings: z
+              .object({
+                select: z.object({
+                  tag: z.boolean().optional(),
+                }),
+              })
+              .optional(),
+            attachments: z
+              .object({
+                select: z.object({
+                  attachment: z.boolean().optional(),
+                }),
+                where: z
+                  .object({
+                    is_image: z.boolean().optional(),
+                  })
+                  .optional(),
+                take: z.number().optional(),
+                orderBy: z
+                  .object({
+                    created_at: z.enum(['asc', 'desc']).optional(),
+                  })
+                  .optional(),
+              })
+              .optional(),
+            rendered_description: z.boolean().optional(),
+            description: z.boolean().optional(),
+            created_at: z.boolean().optional(),
+            start_date: z.boolean().optional(),
+            reactions: z.boolean().optional(),
+            intervals: z.boolean().optional(),
+            column_id: z.boolean().optional(),
+            priority: z.boolean().optional(),
+            due_date: z.boolean().optional(),
+            column: z.boolean().optional(),
+            title: z.boolean().optional(),
+            order: z.boolean().optional(),
+            color: z.boolean().optional(),
+          })
+          .optional(),
+        where: z
+          .object({
+            id: z.string().optional(),
+            AND: z
+              .array(
+                z.object({
+                  OR: z
+                    .array(
+                      z.object({
+                        to_delete: z.boolean().nullable().optional(),
+                      }),
+                    )
+                    .optional(),
+                }),
+              )
+              .optional(),
+          })
+          .optional(),
+      })
 
-    try {
-      const result = allow(taskSchema, allowedFields).safeParse(inputData)
-      expect(result.success).toBe(false)
-    } catch (error) {
-      expect(error).toBeInstanceOf(ZodError)
-    }
+      const allowedFields = [
+        'select.id',
+        'select.project_id',
+        'select.list_id',
+        'select.user_assignments.select.user',
+        'select.tags_mappings.select.tag',
+        'select.attachments.select.attachment',
+        'select.attachments.where.is_image',
+        'select.attachments.take',
+        'select.attachments.orderBy.created_at',
+        'select.rendered_description',
+        'select.description',
+        'select.created_at',
+        'select.start_date',
+        'select.reactions',
+        'select.intervals',
+        'select.column_id',
+        'select.priority',
+        'select.due_date',
+        'select.column',
+        'select.order',
+        'select.color',
+        'where.id',
+        'where.AND[].OR[].to_delete',
+      ]
+
+      try {
+        const result = allow(taskSchema, allowedFields).safeParse(inputData)
+        expect(result.success).toBe(false)
+      } catch (error) {
+        expect(error).toBeInstanceOf(ZodError)
+      }
+    })
+
+    it('deep nesting 2', () => {
+      const taskSchema = z.object({
+        where: z
+          .object({
+            id: z.string().optional(),
+            AND: z
+              .array(
+                z.object({
+                  OR: z
+                    .array(
+                      z.object({
+                        to_delete: z.boolean().nullable().optional(),
+                      }),
+                    )
+                    .optional(),
+                }),
+              )
+              .optional(),
+          })
+          .optional(),
+      })
+
+      const allowedFields = [
+        'select.id',
+        'select.project_id',
+        'select.list_id',
+        'select.user_assignments.select.user',
+        'select.tags_mappings.select.tag',
+        'select.attachments.select.attachment',
+        'select.attachments.where.is_image',
+        'select.attachments.take',
+        'select.attachments.orderBy.created_at',
+        'select.rendered_description',
+        'select.description',
+        'select.created_at',
+        'select.start_date',
+        'where.id',
+        'where.AND[].OR[].to_delete',
+      ]
+
+      try {
+        const result = allow(taskSchema, allowedFields).safeParse(inputData)
+        expect(result.success).toBe(false)
+      } catch (error) {
+        expect(error).toBeInstanceOf(ZodError)
+      }
+    })
   })
 })

package/src/copy/transformZod.ts

@@ -38,10 +38,11 @@ export function allow<T extends ZodTypeAny>(
   schema: T,
   allowedPaths: string[],
 ): ZodEffects<T, any, any> {
-  const rootSchema = schema instanceof z.ZodObject ? schema : undefined
+  const rootSchema = schema instanceof z.ZodObject ? schema.strict() : undefined
 
-  return schema.transform((data) => {
+  return rootSchema?.transform((data) => {
     const flatData = flattenObject(data, '', rootSchema)
+
     const disallowedPaths: string[] = []
 
     for (const key of Object.keys(flatData)) {
@@ -51,19 +52,11 @@ export function allow<T extends ZodTypeAny>(
     }
 
     if (disallowedPaths.length > 0) {
-      const errors: ZodIssue[] = []
-      for (const path of disallowedPaths) {
-        errors.push({
-          code: ZodIssueCode.custom,
-          message: `Field '${path}' is not allowed.`,
-          path: path.split('.'),
-        })
-      }
-      throw new ZodError(errors)
+      throw createZodErrorFromPaths(disallowedPaths, 'Field is not allowed:')
     }
 
     return data
-  }) as ZodEffects<T, any, any>
+  }) as unknown as ZodEffects<T, any, any>
 }
 
 export function forbid<T extends z.ZodTypeAny>(
@@ -82,15 +75,7 @@ export function forbid<T extends z.ZodTypeAny>(
     }
 
     if (forbiddenMatches.length > 0) {
-      const errors: ZodIssue[] = []
-      for (const path of forbiddenMatches) {
-        errors.push({
-          code: ZodIssueCode.custom,
-          message: `Field '${path}' is forbidden.`,
-          path: [path],
-        })
-      }
-      throw new ZodError(errors)
+      throw createZodErrorFromPaths(forbiddenMatches, 'Field is forbidden:')
     }
     return data
   }) as ZodEffects<T, any, any>
@@ -138,3 +123,18 @@ export function flattenObject(
   flatten(obj, prefix, schema)
   return result
 }
+
+function createZodErrorFromPaths(
+  disallowedPaths: string[],
+  errorMessage: string,
+): ZodError {
+  const errors: ZodIssue[] = []
+  for (const path of disallowedPaths) {
+    errors.push({
+      code: ZodIssueCode.custom,
+      message: `${errorMessage} '${path}'`,
+      path: path.split('.'),
+    })
+  }
+  return new ZodError(errors)
+}

package/src/helpers/generateRouteFile.ts

@@ -31,7 +31,7 @@ import { ${modelName}GroupBy } from './${modelName}GroupBy';
 import { createValidatorMiddleware, ValidatorOptions } from '../createValidatorMiddleware'
 import { createOutputValidatorMiddleware } from '../createOutputValidatorMiddleware'
 import { RouteConfig, ValidatorConfig } from '../routeConfig'
-import { parseQueryParams } from "../ParseQueryParams";
+import { parseQueryParams } from "../parseQueryParams";
 
 const defaultBeforeAfter = {
   before: [] as RequestHandler[],