prisma-generator-express 1.64.0 → 1.64.2

package/src/generators/generateRouterHono.ts

@@ -80,6 +80,33 @@ function emitWriteOp(meta: (typeof OPERATION_METADATA)[number], modelName: strin
   }`
 }
 
+/**
+ * Guard dropping is a GENERATION-TIME decision, never a runtime one.
+ *
+ * The emitted router used to compute `DROP_GUARD = <flag> || _env.E2E === 'true'`,
+ * so setting `E2E=true` in a deployed environment downgraded enforcement even
+ * when the generator had been told to keep the guard. The two modes are not
+ * equivalent: with the guard, the shape goes to prisma-guard; with it dropped,
+ * `applyDroppedGuard` applies projection defaults and forced `where` clauses and
+ * nothing else is validated against the shape.
+ *
+ * On an edge runtime that variable is an ordinary config var — set on a staging
+ * deployment, copied forward, flagged as security-relevant nowhere. A
+ * deployment's guard behaviour has to be a property of the artifact, not of the
+ * environment it happens to land in.
+ *
+ * The rationale lives here rather than in the emitted file on purpose: generated
+ * output is an artifact, and a paragraph about a bypass that no longer exists
+ * would be copied into every router this generator writes.
+ *
+ * `updateEach` is refused for the same reason, one step further on. It bypasses
+ * guard shapes by design — the endpoint is a batch of `{ where, data }` items
+ * applied directly — and the only thing between it and an unguarded mass
+ * mutation was a `console.warn` suppressed in production. A warning is not a
+ * security boundary; it is advice to whoever happens to be reading a development
+ * log. Refused at construction rather than silently dropped, so a deployment
+ * expecting the route learns at boot instead of at the first 404.
+ */
 export function generateHonoRouterFunction({
   model,
   enums,
@@ -133,9 +160,9 @@ import { buildModelOpenApi } from '../buildModelOpenApi${ext}'
 import {
   normalizeOperation,
   resolveOperationVariantKey,
+  resolveGuardShapeOnce,
   validateCountSourceWhere,
   validateOperationConfig,
-  validateUpdateEachConfig,
 } from '../routeConfig${ext}'
 import type { NormalizedOperationConfig } from '../routeConfig${ext}'
 import { transformResult } from '../operationRuntime${ext}'
@@ -149,7 +176,9 @@ import { MODEL_FIELDS, MODEL_ENUMS } from './${modelName}Metadata${ext}'
 ${generateRouteConfigType(modelName, 'HonoBeforeHook', guardShapesImport, importStyle, 'hono')}
 const _env = getEnv()
 
-const DROP_GUARD = ${dropGuard} || _env.E2E === 'true'
+// Fixed at generation time. Never read from the environment — see
+// generateRouterHono.ts.
+const DROP_GUARD = ${dropGuard}
 
 type JsonLike =
   | string
@@ -220,19 +249,6 @@ async function parseWriteBodyMiddleware(c: HandlerContext): Promise<void> {
   c.set('body', body)
 }
 
-async function parseUpdateEachBodyMiddleware(c: HandlerContext): Promise<void> {
-  let body: unknown
-  try {
-    body = await c.req.json()
-  } catch {
-    throw new HTTPException(400, { message: 'updateEach body must be an array of { where, data } items' })
-  }
-  if (!Array.isArray(body)) {
-    throw new HTTPException(400, { message: 'updateEach body must be an array of { where, data } items' })
-  }
-  c.set('body', body)
-}
-
 function makeShapeMiddleware<TCtx, TPrisma, TEnv extends HonoEnvBase>(
   config: ${modelName}RouteConfig<TCtx, TPrisma, TEnv>,
   opConfig: NormalizedOp<TEnv>,
@@ -260,15 +276,27 @@ function makeShapeMiddleware<TCtx, TPrisma, TEnv extends HonoEnvBase>(
     if (resolvedKey !== undefined) c.set('guardVariantKey', resolvedKey)
 
     if (opConfig.guardShape) {
+      const resolveCtx = typeof config.resolveContext === 'function'
+        ? () => (config.resolveContext as (ctx: Context<GeneratedHonoEnv<TEnv>>) => unknown | Promise<unknown>)(c)
+        : undefined
+
+      /**
+       * Resolved ONCE, here, and the validated value is what travels onward —
+       * see resolveGuardShapeOnce. Passing the function on would let it return a
+       * different shape when it is enforced than when it was checked.
+       */
+      const resolution = await resolveGuardShapeOnce(opConfig.guardShape, resolvedKey, resolveCtx)
+      if (!resolution.ok) {
+        c.set('guardShapeFailure', resolution.problem)
+        return
+      }
+      const effectiveShape = resolution.shape
+
       if (!DROP_GUARD) {
-        c.set('guardShape', opConfig.guardShape)
+        c.set('guardShape', effectiveShape)
       } else {
-        const resolveCtx = typeof config.resolveContext === 'function'
-          ? () => (config.resolveContext as (ctx: Context<GeneratedHonoEnv<TEnv>>) => unknown | Promise<unknown>)(c)
-          : undefined
-
         await applyDroppedGuard(
-          opConfig.guardShape,
+          effectiveShape,
           resolvedKey,
           resolveCtx,
           opKind,
@@ -419,9 +447,19 @@ export function ${routerFunctionName}<TCtx = unknown, TPrisma = any, TEnv extend
     try {
       await parseFn(c as unknown as HandlerContext)
       await makeShapeMiddleware<TCtx, TPrisma, TEnv>(config, opConfig, opKind)(c)
-      const operationBefore = await runBeforeHooks<TEnv>(opConfig.operationBefore, c)
-      if (operationBefore) return operationBefore
 
+      /**
+       * Variant resolution is settled BEFORE any operation hook runs.
+       *
+       * The check used to sit after \`operationBefore\`, so a hook that returned a
+       * Response — an auth gate, a cache, a short-circuit for a known caller —
+       * answered the request before anyone established which guard applied to
+       * it. A cached response served for a request whose variant could not be
+       * resolved is a response served under a guard nobody chose.
+       *
+       * Hooks that must run first belong outside the generated router, where
+       * they are visibly not part of guard resolution.
+       */
       const failure = c.get('guardVariantFailure')
       if (failure) {
         throw new HTTPException(400, {
@@ -429,6 +467,22 @@ export function ${routerFunctionName}<TCtx = unknown, TPrisma = any, TEnv extend
         })
       }
 
+      /**
+       * A shape function that returned something unusable is a DEPLOYMENT fault,
+       * not a caller fault — 500, and refused here, before any hook can answer
+       * the request and before Prisma is reached. Running unguarded because the
+       * guard failed to produce a guard is the outcome this exists to prevent.
+       */
+      const shapeFailure = c.get('guardShapeFailure')
+      if (shapeFailure) {
+        throw new HTTPException(500, {
+          message: 'guard shape could not be resolved: ' + shapeFailure,
+        })
+      }
+
+      const operationBefore = await runBeforeHooks<TEnv>(opConfig.operationBefore, c)
+      if (operationBefore) return operationBefore
+
       const key = c.get('guardVariantKey')
       const variantHooks =
         key !== undefined ? opConfig.variantHooks[key] : undefined
@@ -454,9 +508,8 @@ export function ${routerFunctionName}<TCtx = unknown, TPrisma = any, TEnv extend
     try {
       await parseWriteBodyMiddleware(c as unknown as HandlerContext)
       await makeShapeMiddleware<TCtx, TPrisma, TEnv>(config, opConfig, opKind)(c)
-      const operationBefore = await runBeforeHooks<TEnv>(opConfig.operationBefore, c)
-      if (operationBefore) return operationBefore
 
+      // Settled before any operation hook — see the read handler above.
       const failure = c.get('guardVariantFailure')
       if (failure) {
         throw new HTTPException(400, {
@@ -464,6 +517,22 @@ export function ${routerFunctionName}<TCtx = unknown, TPrisma = any, TEnv extend
         })
       }
 
+      /**
+       * A shape function that returned something unusable is a DEPLOYMENT fault,
+       * not a caller fault — 500, and refused here, before any hook can answer
+       * the request and before Prisma is reached. Running unguarded because the
+       * guard failed to produce a guard is the outcome this exists to prevent.
+       */
+      const shapeFailure = c.get('guardShapeFailure')
+      if (shapeFailure) {
+        throw new HTTPException(500, {
+          message: 'guard shape could not be resolved: ' + shapeFailure,
+        })
+      }
+
+      const operationBefore = await runBeforeHooks<TEnv>(opConfig.operationBefore, c)
+      if (operationBefore) return operationBefore
+
       const key = c.get('guardVariantKey')
       const variantHooks =
         key !== undefined ? opConfig.variantHooks[key] : undefined
@@ -493,31 +562,14 @@ ${readOpBlocks}
 
 ${writeOpBlocks}
 
+  // Not registered on this target — see generateRouterHono.ts for why.
   if (config.updateEach) {
-    const rawUpdateEach = config.updateEach as unknown as OperationConfigLike<TEnv>
-    validateUpdateEachConfig(rawUpdateEach, '${modelName}.updateEach')
-    const opConfig = normalizeHonoOperation(rawUpdateEach)
-    if (opConfig.operationBefore.length === 0 && _env.NODE_ENV !== 'production') {
-      console.warn(
-        '[${modelName}Router] updateEach is enabled without a before hook. ' +
-        'This endpoint bypasses guard shapes and should be protected by authentication middleware.',
-      )
-    }
-    const path = basePath ? \`\${basePath}/each\` : '/each'
-    app.post(path, async (c: Context<GeneratedHonoEnv<TEnv>>): Promise<Response> => {
-      try {
-        await parseUpdateEachBodyMiddleware(c as unknown as HandlerContext)
-        await makeShapeMiddleware<TCtx, TPrisma, TEnv>(config, opConfig, 'noop')(c)
-        const beforeResponse = await runBeforeHooks<TEnv>(opConfig.operationBefore, c)
-        if (beforeResponse) return beforeResponse
-        await ${modelName}UpdateEach(c as unknown as HandlerContext)
-        const afterResponse = await runAfterHooks<TEnv>(opConfig.operationAfter, c)
-        if (afterResponse) return afterResponse
-        return sendResult(c as unknown as HandlerContext)
-      } catch (error: unknown) {
-        return sendError(c as unknown as HandlerContext, error)
-      }
-    })
+    throw new Error(
+      '${modelName}.updateEach: this target does not register updateEach. It bypasses ' +
+      'guard shapes entirely, so there is no configuration that makes it safe to ' +
+      'expose. Perform batch updates through a guarded operation, or behind your own ' +
+      'authenticated route outside the generated router.',
+    )
   }
 
   return app