prisma-generator-express 1.64.2 → 1.64.4

package/src/copy/routeConfig.hono.ts

@@ -107,6 +107,91 @@ export type RouteConfig<
   >,
   HonoOpKeys
 > & {
+  /**
+   * SEVEN INDEPENDENT GUARD CONTROLS. Every default reproduces the public
+   * package's pre-1.64.2 behaviour exactly.
+   *
+   * 1.64.2 shipped these behaviours ON by default, which was a breaking change
+   * to a published package. The first correction put all seven behind one
+   * `requireGuard` switch, which was also wrong: they are unrelated decisions,
+   * and bundling them means a consumer who wants a missing-guard refusal is also
+   * forced into a hook-ordering change and the removal of a route they may use.
+   *
+   * So each is its own option. An unset option means the upstream default — never
+   * an opinionated value chosen on the consumer's behalf. `HARDENED_GUARD_PROFILE`
+   * selects all seven together for those who want them, but it is a set of values
+   * to spread, not a mode: what gets stored is the individual settings.
+   *
+   * `GUARD_OPTION_METADATA` describes these machine-readably, so a UI can render
+   * them without a hand-maintained second copy of the defaults.
+   */
+
+  /**
+   * Refuse an operation that configures no guard at all. **Default `false`.**
+   *
+   * With it off — the upstream default — an unconfigured operation is emitted and
+   * passes the caller's own where/select/include straight to Prisma. On, router
+   * construction throws, which on a Worker is boot.
+   */
+  requireGuardShape?: boolean
+
+  /**
+   * Validate that a shape constrains something. **Default `false`.**
+   *
+   * On, `shape: {}` and a shape mixing guard keys with non-guard keys (usually a
+   * typo: `wheer`, `iclude`) are refused, at the top level and inside variants.
+   */
+  validateGuardShapes?: boolean
+
+  /**
+   * Require `allowDefaultVariant: true` on an operation carrying a variant named
+   * `default`. **Default `false`.**
+   *
+   * A `default` variant answers every unrecognised, blank and missing caller.
+   * That is safe when it is the most restrictive variant and dangerous when it is
+   * the most permissive, and nothing can tell which from the shape.
+   */
+  requireDefaultVariantOptIn?: boolean
+
+  /**
+   * Register the `updateEach` batch route. **Default `true`.**
+   *
+   * It bypasses guard shapes by design — a batch of `{ where, data }` applied
+   * directly — and is protected only by a development-only warning. Set `false`
+   * to refuse it at router construction.
+   */
+  enableUpdateEach?: boolean
+
+  /**
+   * When guard failures are raised relative to operation `before` hooks.
+   * **Default `'after-hooks'`.**
+   *
+   * `'after-hooks'` is upstream behaviour: a hook may answer the request before
+   * variant resolution is settled. `'before-hooks'` settles the guard first, so a
+   * hook cannot answer a request whose guard was never established.
+   */
+  guardResolutionOrder?: 'after-hooks' | 'before-hooks'
+
+  /**
+   * Honour `E2E=true` in the environment as a guard bypass. **Default `true`.**
+   *
+   * Upstream behaviour, and a real hazard on an edge runtime where that variable
+   * is an ordinary config var — set on staging, copied forward, flagged as
+   * security-relevant nowhere. `false` makes guard behaviour a property of the
+   * artifact alone.
+   */
+  allowE2EGuardBypass?: boolean
+
+  /**
+   * Check what a shape FUNCTION returned before using it. **Default `false`.**
+   *
+   * A function shape is opaque at construction time. On, a resolved value that is
+   * empty, not an object, or carrying non-guard keys fails the request with 500 —
+   * a deployment fault, not a caller fault — instead of running unguarded. It
+   * also resolves the function exactly once and passes the validated value on.
+   */
+  validateResolvedShapes?: boolean
+
   findUnique?: OperationConfig<TShape, TEnv> | false
   findUniqueOrThrow?: OperationConfig<TShape, TEnv> | false
   findFirst?: OperationConfig<TShape, TEnv> | false

package/src/copy/routeConfig.ts

@@ -119,6 +119,14 @@ export type BaseOperationConfig<
   before?: TBefore[]
   after?: TAfter[]
   pagination?: Partial<PaginationConfig>
+  /**
+   * Confirms that a variant literally named `default` is meant to answer every
+   * unrecognised, blank and missing caller.
+   *
+   * Only consulted when `requireDefaultVariantOptIn` is on. Otherwise the key
+   * behaves as it always has, so this is inert for existing configurations.
+   */
+  allowDefaultVariant?: boolean
 }
 
 export interface BaseUpdateEachConfig<TBefore, TAfter = TBefore> {
@@ -216,6 +224,77 @@ type OperationConfigInput<TBefore, TAfter> = {
   pagination?: Partial<PaginationConfig>
 }
 
+/**
+ * The seven guard controls, resolved — the RUNTIME half.
+ *
+ * This lives here, not in the compiled `src/guardOptions.ts`, because a generated
+ * project gets these files copied in and must run with no dependency on this
+ * package. The two cannot import each other across that boundary, so the values
+ * appear twice and `guardOptionIndependence.test.ts` asserts they agree — against
+ * this resolver, which is the one the router actually runs.
+ *
+ * The machine-readable METADATA is compiled and public: see src/guardOptions.ts.
+ * Defining it here would put it in a file that never reaches `dist`.
+ */
+export type GuardPolicy = {
+  requireGuardShape: boolean
+  validateGuardShapes: boolean
+  requireDefaultVariantOptIn: boolean
+  enableUpdateEach: boolean
+  guardResolutionOrder: 'after-hooks' | 'before-hooks'
+  allowE2EGuardBypass: boolean
+  validateResolvedShapes: boolean
+}
+
+/**
+ * PRE-1.64.2 BEHAVIOUR, exactly. Changing any value here changes what an
+ * unconfigured consumer gets on upgrade, which is the thing that must not happen.
+ */
+export const UPSTREAM_GUARD_DEFAULTS: Readonly<GuardPolicy> = Object.freeze({
+  requireGuardShape: false,
+  validateGuardShapes: false,
+  requireDefaultVariantOptIn: false,
+  enableUpdateEach: true,
+  guardResolutionOrder: 'after-hooks',
+  allowE2EGuardBypass: true,
+  validateResolvedShapes: false,
+})
+
+/**
+ * Every control at its most restrictive — a SHORTCUT, not a mode.
+ *
+ * Spread it, edit what you disagree with, and store the result. There is
+ * deliberately no `preset: 'hardened'` option: a stored preset name would mean a
+ * future version of this package could silently change what a consumer's
+ * configuration does, which is the same class of mistake as 1.64.2 itself.
+ */
+export const HARDENED_GUARD_PROFILE: Readonly<GuardPolicy> = Object.freeze({
+  requireGuardShape: true,
+  validateGuardShapes: true,
+  requireDefaultVariantOptIn: true,
+  enableUpdateEach: false,
+  guardResolutionOrder: 'before-hooks',
+  allowE2EGuardBypass: false,
+  validateResolvedShapes: true,
+})
+
+/** Fill in the defaults. Absent means upstream, never an opinion. */
+export function resolveGuardPolicy(config: Partial<GuardPolicy> | undefined): GuardPolicy {
+  return {
+    requireGuardShape: config?.requireGuardShape ?? UPSTREAM_GUARD_DEFAULTS.requireGuardShape,
+    validateGuardShapes: config?.validateGuardShapes ?? UPSTREAM_GUARD_DEFAULTS.validateGuardShapes,
+    requireDefaultVariantOptIn:
+      config?.requireDefaultVariantOptIn ?? UPSTREAM_GUARD_DEFAULTS.requireDefaultVariantOptIn,
+    enableUpdateEach: config?.enableUpdateEach ?? UPSTREAM_GUARD_DEFAULTS.enableUpdateEach,
+    guardResolutionOrder:
+      config?.guardResolutionOrder ?? UPSTREAM_GUARD_DEFAULTS.guardResolutionOrder,
+    allowE2EGuardBypass:
+      config?.allowE2EGuardBypass ?? UPSTREAM_GUARD_DEFAULTS.allowE2EGuardBypass,
+    validateResolvedShapes:
+      config?.validateResolvedShapes ?? UPSTREAM_GUARD_DEFAULTS.validateResolvedShapes,
+  }
+}
+
 function classifyGuardRouting(shape: unknown): NormalizedGuardRouting {
   if (shape === undefined) return { kind: 'none' }
   if (typeof shape === 'function') return { kind: 'single' }
@@ -295,34 +374,79 @@ function validateShapeConfig(shape: unknown, location: string): void {
 export function validateOperationConfig(
   config: { shape?: unknown; variants?: unknown; allowDefaultVariant?: unknown } | undefined,
   location: string,
+  policy: Partial<GuardPolicy> = {},
 ): void {
+  const { requireGuardShape, validateGuardShapes, requireDefaultVariantOptIn } =
+    resolveGuardPolicy(policy)
+
+  /**
+   * THE CHECKS THAT PREDATE 1.64.2 RUN UNCONDITIONALLY.
+   *
+   * Everything below them is gated per option. Note each gate stands alone: a
+   * consumer who enables `validateGuardShapes` gets shape validation and NOT a
+   * missing-guard refusal, and vice versa. That independence is the point, and
+   * `guardOptionIndependence.test.ts` asserts it option by option.
+   */
   if (!config) {
-    throw new Error(
-      location + ': no guard configured. Every generated operation must define ' +
-      '"shape" or "variants"; an unguarded operation would pass the caller\'s ' +
-      'own where/select/include straight to Prisma.',
-    )
+    if (requireGuardShape) {
+      throw new Error(
+        location + ': no guard configured. Every generated operation must define ' +
+        '"shape" or "variants"; an unguarded operation would pass the caller\'s ' +
+        'own where/select/include straight to Prisma.',
+      )
+    }
+    return
   }
 
   const hasShape = config.shape !== undefined
   const hasVariants = config.variants !== undefined
 
+  // Pre-1.64.2. Not gated.
   if (hasShape && hasVariants) {
     throw new Error(location + ': shape and variants cannot both be defined')
   }
 
   if (!hasShape && !hasVariants) {
-    throw new Error(
-      location + ': no guard configured. Define "shape" or "variants".',
-    )
+    if (requireGuardShape) {
+      throw new Error(
+        location + ': no guard configured. Define "shape" or "variants".',
+      )
+    }
+    return
   }
 
   if (hasShape) {
-    validateShapeConfig(config.shape, location)
+    if (validateGuardShapes) validateShapeConfig(config.shape, location)
     return
   }
 
-  const variants = config.variants
+  validateVariantMap(
+    config.variants,
+    location,
+    { validateGuardShapes, requireDefaultVariantOptIn },
+    config.allowDefaultVariant,
+  )
+}
+
+/**
+ * The variant-map checks.
+ *
+ * The four that predate 1.64.2 — non-array object, at least one entry, no
+ * reserved-key collision, every entry an object carrying a `shape` — run
+ * ALWAYS, because they are not new and removing them would be its own breaking
+ * change.
+ *
+ * The two the hardening added are gated on their OWN options, independently:
+ * `requireDefaultVariantOptIn` confirms a `default` variant,
+ * `validateGuardShapes` validates each variant's shape the way a top-level
+ * `shape` is validated. Enabling either does not enable the other.
+ */
+function validateVariantMap(
+  variants: unknown,
+  location: string,
+  flags: { validateGuardShapes: boolean; requireDefaultVariantOptIn: boolean },
+  allowDefaultVariant?: unknown,
+): void {
   if (!isPlainObject(variants)) {
     throw new Error(location + ': variants must be a non-array object')
   }
@@ -343,18 +467,20 @@ export function validateOperationConfig(
    * writes on purpose; a key called `default` is one they may have typed without
    * noticing what it catches.
    */
-  if (Object.prototype.hasOwnProperty.call(variants, 'default')) {
-    if (config.allowDefaultVariant !== true) {
+  if (flags.requireDefaultVariantOptIn) {
+    if (Object.prototype.hasOwnProperty.call(variants, 'default')) {
+      if (allowDefaultVariant !== true) {
+        throw new Error(
+          location + ': a variant named "default" answers every unrecognised, ' +
+          'blank and missing caller. Set allowDefaultVariant: true to confirm ' +
+          'that is intended, and make sure it is the most restrictive variant.',
+        )
+      }
+    } else if (allowDefaultVariant !== undefined) {
       throw new Error(
-        location + ': a variant named "default" answers every unrecognised, ' +
-        'blank and missing caller. Set allowDefaultVariant: true to confirm ' +
-        'that is intended, and make sure it is the most restrictive variant.',
+        location + ': allowDefaultVariant is set but no "default" variant exists.',
       )
     }
-  } else if (config.allowDefaultVariant !== undefined) {
-    throw new Error(
-      location + ': allowDefaultVariant is set but no "default" variant exists.',
-    )
   }
 
   for (const [key, rawEntry] of entries) {
@@ -384,7 +510,9 @@ export function validateOperationConfig(
      * different key. A guard is not more trustworthy for being written inside a
      * variant.
      */
-    validateShapeConfig(rawEntry.shape, location + ' variant "' + key + '"')
+    if (flags.validateGuardShapes) {
+      validateShapeConfig(rawEntry.shape, location + ' variant "' + key + '"')
+    }
   }
 }
 

package/src/generators/generateQueryBuilderHelper.ts

@@ -1,6 +1,8 @@
 import { GeneratorOptions } from '@prisma/generator-helper'
 
-export function generateQueryBuilderHelper(options: GeneratorOptions): string {
+export function generateQueryBuilderHelper(
+  options: Pick<GeneratorOptions, 'schemaPath'>,
+): string {
   const schemaPath = options.schemaPath
     ? JSON.stringify(options.schemaPath)
     : "resolve(process.cwd(), 'prisma/schema.prisma')"
@@ -52,7 +54,7 @@ export function startQueryBuilder(options: QueryBuilderOptions = {}): void {
 
 function doStart(options: QueryBuilderOptions): Promise<void> {
   return new Promise<void>((resolvePromise) => {
-    const env = typeof process !== 'undefined' && process.env ? process.env : {} as Record<string, string | undefined>
+    const env = process.env
 
     if (env.NODE_ENV === 'production') {
       resolvePromise()
@@ -97,7 +99,7 @@ function doStart(options: QueryBuilderOptions): Promise<void> {
 
     const schemaCwd = dirname(resolve(schemaPath))
 
-    _process = spawn(process.execPath, [cliPath], {
+    const child = spawn(process.execPath, [cliPath], {
       stdio: 'inherit',
       env: {
         ...env,
@@ -110,14 +112,15 @@ function doStart(options: QueryBuilderOptions): Promise<void> {
         DATABASE_URL: databaseUrl,
       },
     })
+    _process = child
 
-    _process.on('error', (err) => {
+    child.on('error', (err) => {
       console.error('[query-builder] Failed to start:', err.message)
       _process = null
       resolvePromise()
     })
 
-    _process.on('exit', (code) => {
+    child.on('exit', (code) => {
       const wasStopping = _stopping
       _stopping = false
       _process = null
@@ -160,4 +163,4 @@ export function stopQueryBuilder(): void {
   _process.kill()
 }
 `
-}
+}

package/src/generators/generateRouteConfigType.ts

@@ -117,10 +117,15 @@ export function generateRouteConfigType(
       `      after?: ${afterRef}[]\n` +
       `    }>`
 
+    // Only consulted when `requireDefaultVariantOptIn` is on; inert otherwise.
+    // Emitted so a TypeScript consumer who opts in can confirm a `default`
+    // variant without a cast — 1.64.2 demanded it and never added it to the type.
+    const allowDefault = `    allowDefaultVariant?: boolean`
+
     return (
       `  ${routerOp}?: (${commonConfig} & (\n` +
       `    | { shape?: ${m}${c}ShapeInput<TCtx>; variants?: never }\n` +
-      `    | { shape?: never; variants: ${variantsConfig} }\n` +
+      `    | { shape?: never; variants: ${variantsConfig}\n${allowDefault} }\n` +
       `  )) | false`
     )
   }).join('\n')