prisma-generator-express 1.65.2 → 1.67.0

package/src/generators/generateRelationMeta.ts

@@ -32,13 +32,15 @@ function findOppositeField(
   const target = models.find((m) => m.name === targetModelName)
   if (!target) return null
   const isSelfRelation = targetModelName === selfModelName
-  return target.fields.find(
-    (f) =>
-      f.kind === 'object' &&
-      f.relationName === relationName &&
-      f.type === selfModelName &&
-      !(isSelfRelation && f.name === selfFieldName),
-  ) || null
+  return (
+    target.fields.find(
+      (f) =>
+        f.kind === 'object' &&
+        f.relationName === relationName &&
+        f.type === selfModelName &&
+        !(isSelfRelation && f.name === selfFieldName),
+    ) || null
+  )
 }
 
 function computeRelation(
@@ -61,7 +63,13 @@ function computeRelation(
     }
   }
 
-  const opposite = findOppositeField(models, field.type, field.relationName, selfModelName, field.name)
+  const opposite = findOppositeField(
+    models,
+    field.type,
+    field.relationName,
+    selfModelName,
+    field.name,
+  )
   if (opposite) {
     const oppFrom = (opposite.relationFromFields ?? []) as string[]
     const oppTo = (opposite.relationToFields ?? []) as string[]
@@ -118,7 +126,9 @@ export interface GenerateRelationMetaOptions {
   importStyle: ImportStyle
 }
 
-export function generateRelationMeta(options: GenerateRelationMetaOptions): string {
+export function generateRelationMeta(
+  options: GenerateRelationMetaOptions,
+): string {
   const ext = importExt(options.importStyle)
   const meta = buildModelMeta(options.model, options.allModels)
   return `import type { ModelRelationMap } from '../autoIncludePlanner${ext}'
@@ -132,7 +142,9 @@ export interface GenerateRelationModelsIndexOptions {
   importStyle: ImportStyle
 }
 
-export function generateRelationModelsIndex(options: GenerateRelationModelsIndexOptions): string {
+export function generateRelationModelsIndex(
+  options: GenerateRelationModelsIndexOptions,
+): string {
   const ext = importExt(options.importStyle)
   const imports = options.modelNames
     .map((n) => `import { ${n}Relations } from './${n}/${n}Relations${ext}'`)
@@ -147,4 +159,4 @@ export const relationModels: Record<string, ModelRelationMap> = {
 ${entries}
 }
 `
-}
+}

package/src/generators/generateRouteConfigType.ts

@@ -1,11 +1,14 @@
-import { ImportStyle } from '../utils/resolveImportStyle'
+import type { ImportStyle } from '../utils/resolveImportStyle'
 import { importExt } from '../utils/importExt'
 import type { Target } from '../constants'
-import { OPERATION_METADATA, READ_OPERATION_NAMES } from '../copy/operationDefinitions'
+import {
+  OPERATION_METADATA,
+  READ_OPERATION_NAMES,
+} from '../copy/operationDefinitions'
 
-const ROUTER_OPERATIONS = OPERATION_METADATA
-  .filter((m) => m.name !== 'updateEach')
-  .map((m) => m.name)
+const ROUTER_OPERATIONS = OPERATION_METADATA.filter(
+  (m) => m.name !== 'updateEach',
+).map((m) => m.name)
 
 function capitalize(str: string): string {
   return str.charAt(0).toUpperCase() + str.slice(1)
@@ -13,15 +16,15 @@ function capitalize(str: string): string {
 
 function requestTypeFor(target: Target): string {
   if (target === 'fastify') return `import('fastify').FastifyRequest`
-  if (target === 'hono') return `import('hono').Context<TEnv>`
+  if (target === 'hono') return `import('hono').Context<GeneratedHonoEnv<TEnv>>`
   return `import('express').Request`
 }
 
 function configGenericsFor(target: Target): string {
   if (target === 'hono') {
-    return `<TCtx = unknown, TPrisma = any, TEnv extends { Variables: Record<string, unknown> } = { Variables: Record<string, unknown> }>`
+    return `<TCtx = unknown, TPrisma extends PrismaClientLike = PrismaClientLike, TEnv extends { Variables: Record<string, unknown> } = { Variables: Record<string, unknown> }>`
   }
-  return `<TCtx = unknown, TPrisma = any>`
+  return `<TCtx = unknown, TPrisma extends PrismaClientLike = PrismaClientLike>`
 }
 
 function routeConfigBaseFor(target: Target): string {
@@ -50,6 +53,7 @@ export function generateRouteConfigType(
   guardShapesImport: string | null,
   importStyle: ImportStyle,
   target: Target,
+  clientImport?: string,
 ): string {
   const ext = importExt(importStyle)
   const m = modelName
@@ -61,14 +65,33 @@ export function generateRouteConfigType(
   const afterRef = afterHookRef(target, hookHandlerType)
   const requestType = requestTypeFor(target)
 
-  const progressiveTypeImport = supportsProgressive
+  const clientPath = clientImport ? `${clientImport}${ext}` : '@prisma/client'
+  const delegate = `${m.charAt(0).toLowerCase() + m.slice(1)}`
+  const modelDelegate = clientImport
+    ? `PrismaClient['${delegate}']`
+    : `(TPrisma extends Record<'${delegate}', infer D> ? D : never)`
+  const overrideImports = `import type { Prisma${clientImport ? ', PrismaClient' : ''} } from '${clientPath}'\nimport type { OperationOverride } from '../operationRuntime${ext}'\n`
+  const overrideType = (op: string) => {
+    const method = op === 'findManyPaginated' ? 'findMany' : op
+    const args = `Prisma.Args<${modelDelegate}, '${method}'>`
+    const result = `Prisma.Result<${modelDelegate}, ${args}, '${method}'>`
+    const output =
+      op === 'findManyPaginated'
+        ? `{ data: ${result}; total: number; hasMore: boolean }`
+        : result
+    const methods =
+      op === 'findManyPaginated' ? "'findMany' | 'count'" : `'${method}'`
+    return `OperationOverride<${args}, ${output}, TCtx, Readonly<{ ${delegate}: Pick<${modelDelegate}, Extract<keyof ${modelDelegate}, ${methods}>> }>>`
+  }
+  const typeImports = supportsProgressive
     ? `import type { ProgressiveVariantConfig, ProgressiveStage } from '../routeConfig.target${ext}'\n`
     : ''
 
   if (!guardShapesImport) {
     return (
-      progressiveTypeImport +
-      `export type ${m}RouteConfig${generics} = ${baseConfig}\n`
+      overrideImports +
+      typeImports +
+      `export type ${m}RouteConfig${generics} = Omit<${baseConfig}, ${ROUTER_OPERATIONS.map((op) => `'${op}'`).join(' | ')}> & {\n${ROUTER_OPERATIONS.map((op) => `  ${op}?: (Omit<Exclude<${baseConfig}['${op}'], false | undefined>, 'override'> & { override?: ${overrideType(op)} }) | false`).join('\n')}\n}\n`
     )
   }
 
@@ -95,6 +118,8 @@ export function generateRouteConfigType(
     const c = capitalize(routerOp)
     const isRead = READ_OPERATION_NAMES.has(routerOp)
     const commonLines = [
+      `    override?: ${overrideType(routerOp)}`,
+      `    authorize?: ${beforeRef}`,
       `    before?: ${beforeRef}[]`,
       `    after?: ${afterRef}[]`,
       `    pagination?: Partial<PaginationConfig>`,
@@ -133,7 +158,8 @@ export function generateRouteConfigType(
   const omitKeys = ROUTER_OPERATIONS.map((k) => `'${k}'`).join('\n  | ')
 
   return (
-    progressiveTypeImport +
+    overrideImports +
+    typeImports +
     `import type {\n  ${opShapeImports}\n} from '${guardShapesImport}${ext}'\n\n` +
     `${shapeOrFnAliases}\n\n` +
     `export type ${m}RouteConfig${generics} = Omit<\n` +
@@ -144,4 +170,4 @@ export function generateRouteConfigType(
     `  resolveContext?: (request: ${requestType}) => TCtx | Promise<TCtx>\n` +
     `${overrides}\n}\n`
   )
-}
+}

package/src/generators/generateRouter.ts

@@ -1,8 +1,9 @@
-import { DMMF } from '@prisma/generator-helper'
+import type { DMMF } from '@prisma/generator-helper'
 import { generateRouteConfigType } from './generateRouteConfigType'
-import { ImportStyle } from '../utils/resolveImportStyle'
+import type { ImportStyle } from '../utils/resolveImportStyle'
 import { importExt } from '../utils/importExt'
-import { WriteStrategy, FindManyPaginatedMode } from '../constants'
+import type { WriteStrategy, FindManyPaginatedMode } from '../constants'
+import { modelPathSegment, type PathCase } from '../utils/pathCasing'
 import { OPERATION_METADATA } from '../copy/operationDefinitions'
 
 function pathExpr(basePath: string, suffix: string): string {
@@ -55,10 +56,11 @@ function emitReadOp(
   const opKind = opKindFor(meta.name)
 
   const postReadBlock = meta.supportsPostRead
-    ? `    if (postReadsEnabled) {
+    ? `    if (resolvePostReadsEnabled(config.disablePostReads, opConfig.disablePostReads)) {
       const postPath = ${meta.name === 'findMany' ? "basePath ? `${basePath}/read` : '/read'" : `path`}
       router.post(
         postPath,
+        ...(opConfig.authorize ? [opConfig.authorize] : []),
         parseBodyAsQuery,
         setShape(opConfig, '${opKind}'),
         ...opConfig.operationBefore,
@@ -77,12 +79,14 @@ function emitReadOp(
     const path = ${pathValue}
     router.get(
       path,
+      ...(opConfig.authorize ? [opConfig.authorize] : []),
       parseQuery,
       setShape(opConfig, '${opKind}'),
       ...opConfig.operationBefore,
       requireVariantKey(),
       variantBeforeDispatcher(opConfig),
       maybeProgressiveSSE(opConfig, core.${meta.coreName}, '${meta.name}'),
+      ${meta.name === 'findMany' ? 'maybeNdjsonFindMany(core.findMany),' : ''}
       ${handlerName} as RequestHandler,
       variantAfterDispatcher(opConfig),
       ...opConfig.operationAfter,
@@ -107,6 +111,7 @@ function emitWriteOp(
     const path = ${pathValue}
     router.${meta.method}(
       path,
+      ...(opConfig.authorize ? [opConfig.authorize] : []),
       setShape(opConfig, '${opKind}'),
       ...opConfig.operationBefore,
       requireVariantKey(),
@@ -123,22 +128,26 @@ export function generateRouterFunction({
   model,
   enums,
   guardShapesImport,
+  clientImport,
   importStyle,
   writeStrategy,
   findManyPaginatedMode,
   dropGuard,
+  pathCase,
 }: {
   model: DMMF.Model
   enums: DMMF.DatamodelEnum[]
   guardShapesImport: string | null
+  clientImport?: string
   importStyle: ImportStyle
   writeStrategy: WriteStrategy
   findManyPaginatedMode: FindManyPaginatedMode
   dropGuard: boolean
+  pathCase: PathCase
 }): string {
   const ext = importExt(importStyle)
   const modelName = model.name
-  const modelNameLower = modelName.toLowerCase()
+  const modelSegment = modelPathSegment(modelName, pathCase)
   const delegateKey = modelName.charAt(0).toLowerCase() + modelName.slice(1)
   const routerFunctionName = `${modelName}Router`
 
@@ -173,9 +182,10 @@ import type {
   QueryBuilderConfig,
   FindManyPaginatedMode,
   PaginationConfig,
+  PrismaClientLike,
 } from '../routeConfig.target${ext}'
 import { parseQueryParams } from '../parseQueryParams${ext}'
-import { sanitizeKeys, normalizePrefix, getEnv, isPlainObject } from '../misc${ext}'
+import { sanitizeKeys, normalizePrefix, getEnv, isPlainObject, resolveDropGuardEnv } from '../misc${ext}'
 import { buildModelOpenApi } from '../buildModelOpenApi${ext}'
 import {
   normalizeOperation,
@@ -183,7 +193,10 @@ import {
   validateCountSourceWhere,
   validateOperationConfig,
   validateUpdateEachConfig,
+  resolvePostReadsEnabled,
+  warnIfUnguardedRoutes,
 } from '../routeConfig${ext}'
+import type { RuntimeOperationOverride } from '../operationRuntime${ext}'
 import type { NormalizedOperationConfig } from '../routeConfig${ext}'
 import type { OperationContext } from '../operationRuntime${ext}'
 import { transformResult } from '../operationRuntime${ext}'
@@ -191,6 +204,7 @@ import { HttpError, mapError } from '../errorMapper${ext}'
 import { formatGuardVariantResolutionError } from '../guardVariantError${ext}'
 import type { GuardVariantResolution } from '../guardVariantRouting${ext}'
 import { mergePaginationConfig } from '../pagination${ext}'
+import { acceptsNdjson, runNdjsonFindMany } from '../ndjson${ext}'
 import {
   acceptsEventStream,
   runProgressiveEndpoint,
@@ -204,13 +218,18 @@ import { applyDroppedGuard } from '../projectionDefaults${ext}'
 import type { OpKind } from '../projectionDefaults${ext}'
 import { MODEL_FIELDS, MODEL_ENUMS } from './${modelName}Metadata${ext}'
 
-${generateRouteConfigType(modelName, 'RequestHandler', guardShapesImport, importStyle, 'express')}
+${generateRouteConfigType(modelName, 'RequestHandler', guardShapesImport, importStyle, 'express', clientImport)}
 const _env = getEnv()
 
 const FIND_MANY_PAGINATED_MODE: FindManyPaginatedMode = '${findManyPaginatedMode}'
-const DROP_GUARD = ${dropGuard} || _env.E2E === 'true'
+// Fixed at generation time. The environment bypass is resolved per router,
+// because it requires the configuration's explicit \`allowE2EGuardBypass: true\`:
+// false or omitted means the environment cannot drop guards for this target.
+const DROP_GUARD = ${dropGuard}
 
 type OperationConfigLike = {
+  authorize?: RequestHandler
+  override?: RuntimeOperationOverride
   before?: RequestHandler[]
   after?: RequestHandler[]
   shape?: unknown
@@ -233,7 +252,7 @@ type NormalizedOp = NormalizedOperationConfig<RequestHandler, RequestHandler> &
 }
 
 type ExtendedRequest = Request & {
-  prisma?: unknown
+  prisma?: PrismaClientLike
   postgres?: unknown
   sqlite?: unknown
 }
@@ -243,6 +262,8 @@ type LocalsBag = {
   routeConfig?: { pagination?: PaginationConfig }
   guardShape?: Record<string, unknown>
   guardCaller?: string
+  operationOverride?: RuntimeOperationOverride
+  resolveOperationContext?: () => unknown | Promise<unknown>
   guardVariantKey?: string
   guardVariantFailure?: Extract<GuardVariantResolution, { ok: false }>
   data?: unknown
@@ -360,7 +381,7 @@ function requireVariantKey(): RequestHandler {
   }
 }
 
-export function ${routerFunctionName}<TCtx = unknown, TPrisma = any>(config: ${modelName}RouteConfig<TCtx, TPrisma> = {}) {
+export function ${routerFunctionName}<TCtx = unknown, TPrisma extends PrismaClientLike = PrismaClientLike>(config: ${modelName}RouteConfig<TCtx, TPrisma> = {}) {
   validateCountSourceWhere(config.pagination?.countSource, '${modelName} pagination')
   validateCountSourceWhere(
     (config.findManyPaginated && typeof config.findManyPaginated === 'object' ? config.findManyPaginated : undefined)?.pagination?.countSource,
@@ -370,6 +391,7 @@ export function ${routerFunctionName}<TCtx = unknown, TPrisma = any>(config: ${m
   const router = express.Router()
 
   const isEnabled = (value: unknown): boolean => value !== false && !!(config.enableAll || value)
+  warnIfUnguardedRoutes('${modelName}', ['findMany', 'findUnique', 'findUniqueOrThrow', 'findFirst', 'findFirstOrThrow', 'findManyPaginated', 'count', 'aggregate', 'groupBy', 'create', 'createMany', 'createManyAndReturn', 'update', 'updateMany', 'updateManyAndReturn', 'upsert', 'delete', 'deleteMany'], config, isEnabled)
 
   const opFor = (key: string): NormalizedOp => {
     const raw = (config as unknown as Record<string, unknown>)[key] as OperationConfigLike | undefined
@@ -378,13 +400,12 @@ export function ${routerFunctionName}<TCtx = unknown, TPrisma = any>(config: ${m
   }
 
   const customPrefix = normalizePrefix(config.customUrlPrefix || '')
-  const modelPrefix = config.addModelPrefix !== false ? '/${modelNameLower}' : ''
+  const modelPrefix = config.addModelPrefix !== false ? '/${modelSegment}' : ''
   const basePath = customPrefix + modelPrefix
 
   const openApiDisabled = config.disableOpenApi === true
     || (config.disableOpenApi !== false && (_env.DISABLE_OPENAPI === 'true' || _env.NODE_ENV === 'production'))
 
-  const postReadsEnabled = !config.disablePostReads
 
   let _openApiJsonCache: unknown = undefined
   const getOpenApiJson = (): unknown => {
@@ -394,7 +415,7 @@ export function ${routerFunctionName}<TCtx = unknown, TPrisma = any>(config: ${m
         MODEL_FIELDS as unknown as Parameters<typeof buildModelOpenApi>[1],
         MODEL_ENUMS as unknown as Parameters<typeof buildModelOpenApi>[2],
         config as unknown as Parameters<typeof buildModelOpenApi>[3],
-        { format: 'json', writeStrategy: '${writeStrategy}' },
+        { format: 'json', writeStrategy: '${writeStrategy}', pathSegment: '${modelSegment}' },
       )
     }
     return _openApiJsonCache
@@ -407,7 +428,7 @@ export function ${routerFunctionName}<TCtx = unknown, TPrisma = any>(config: ${m
         MODEL_FIELDS as unknown as Parameters<typeof buildModelOpenApi>[1],
         MODEL_ENUMS as unknown as Parameters<typeof buildModelOpenApi>[2],
         config as unknown as Parameters<typeof buildModelOpenApi>[3],
-        { format: 'yaml', writeStrategy: '${writeStrategy}' },
+        { format: 'yaml', writeStrategy: '${writeStrategy}', pathSegment: '${modelSegment}' },
       ) as string
     }
     return _openApiYamlCache
@@ -429,6 +450,8 @@ export function ${routerFunctionName}<TCtx = unknown, TPrisma = any>(config: ${m
     const extReq = req as ExtendedRequest
     const locals = readLocals(res)
     return {
+      operationOverride: locals.operationOverride,
+      resolveOperationContext: locals.resolveOperationContext,
       prisma: extReq.prisma,
       postgres: extReq.postgres,
       sqlite: extReq.sqlite,
@@ -436,6 +459,7 @@ export function ${routerFunctionName}<TCtx = unknown, TPrisma = any>(config: ${m
       body: req.body,
       guardShape: locals.guardShape,
       guardCaller: locals.guardCaller,
+      guardVariantKey: locals.guardVariantKey,
       paginationConfig: locals.routeConfig?.pagination,
       findManyPaginatedMode: FIND_MANY_PAGINATED_MODE,
     }
@@ -463,10 +487,25 @@ export function ${routerFunctionName}<TCtx = unknown, TPrisma = any>(config: ${m
     next()
   }
 
+  /**
+   * The environment bypass, and it is OPT-IN for this target.
+   *
+   * \`PGE_DROP_GUARD=true\` (deprecated alias \`E2E=true\`) downgrading enforcement
+   * in a deployed environment is a real hazard: on most platforms it is an
+   * ordinary config var, set on staging, copied forward, flagged as
+   * security-relevant nowhere. It is honoured only when this configuration
+   * states \`allowE2EGuardBypass: true\` — false or omitted means the environment
+   * cannot drop guards. The generation-time \`DROP_GUARD\` literal is unchanged.
+   */
+  const dropGuard = DROP_GUARD || (config.allowE2EGuardBypass === true && resolveDropGuardEnv(_env))
+
   const setShape = (opConfig: NormalizedOp, opKind: OpKind): RequestHandler => {
     return async (req, res, next) => {
       try {
         const locals = readLocals(res)
+        locals.operationOverride = opConfig.override
+        let context: Promise<unknown> | undefined
+        locals.resolveOperationContext = () => context ??= Promise.resolve(config.resolveContext?.(req))
         const merged = mergePaginationConfig(config.pagination, opConfig.pagination)
         if (merged) {
           locals.routeConfig = { pagination: merged }
@@ -491,7 +530,7 @@ export function ${routerFunctionName}<TCtx = unknown, TPrisma = any>(config: ${m
         if (resolvedKey !== undefined) locals.guardVariantKey = resolvedKey
 
         if (opConfig.guardShape) {
-          if (!DROP_GUARD) {
+          if (!dropGuard) {
             locals.guardShape = opConfig.guardShape
           } else {
             await applyDroppedGuard(
@@ -526,6 +565,41 @@ export function ${routerFunctionName}<TCtx = unknown, TPrisma = any>(config: ${m
     }
   }
 
+  const maybeNdjsonFindMany = (
+    coreFn: (ctx: OperationContext) => Promise<unknown>,
+  ): RequestHandler => {
+    return async (req, res, next) => {
+      if (res.headersSent || res.writableEnded) return next()
+      if (req.method !== 'GET') return next()
+      if (!acceptsNdjson(req.headers.accept)) return next()
+
+      const locals = readLocals(res)
+      const rawArgs = (locals.parsedQuery ?? {}) as Record<string, unknown>
+      const args = { ...rawArgs }
+      const paginationCfg = mergePaginationConfig(config.pagination, undefined)
+      const requestedTake = typeof rawArgs.take === 'number' ? rawArgs.take : undefined
+      const initialSkip = typeof rawArgs.skip === 'number' ? rawArgs.skip : 0
+
+      try {
+        await runNdjsonFindMany({
+          res,
+          isClosed: () => req.destroyed,
+          fetchPage: (skip, pageTake) =>
+            coreFn({
+              ...buildContext(req, res),
+              parsedQuery: { ...args, skip, take: pageTake },
+            }),
+          initialSkip,
+          requestedTake,
+          defaultLimit: paginationCfg?.defaultLimit,
+          maxLimit: paginationCfg?.maxLimit ?? 1000,
+        })
+      } catch (err) {
+        next(err)
+      }
+    }
+  }
+
   const maybeProgressiveSSE = (
     opConfig: NormalizedOp,
     coreFn: (ctx: OperationContext) => Promise<unknown>,
@@ -552,6 +626,23 @@ export function ${routerFunctionName}<TCtx = unknown, TPrisma = any>(config: ${m
         }
 
         if (progressiveConfig.mode === 'autoInclude') {
+        if (progressiveConfig.experimental !== true) {
+          if (_env.NODE_ENV !== 'production') {
+            console.warn(
+              '[prisma-generator-express] auto-include progressive is experimental; set \`experimental: true\` on the progressive config to enable it. Falling back.'
+            )
+          }
+          if (progressiveConfig.fallback === 'error') {
+            emitTerminalSSEError(res, 'auto-include requires experimental: true')
+            return
+          }
+          await runSingleResultSSE({
+            req,
+            res,
+            coreQueryFn: () => coreFn(buildContext(req, res)),
+          })
+          return
+        }
           const isAutoIncludeReadable =
             baseOp === 'findUnique' || baseOp === 'findUniqueOrThrow' ||
             baseOp === 'findFirst' || baseOp === 'findFirstOrThrow' ||
@@ -619,11 +710,16 @@ export function ${routerFunctionName}<TCtx = unknown, TPrisma = any>(config: ${m
         }
 
         const ctx = await config.resolveContext(req)
+        const prismaClient = (req as ExtendedRequest).prisma
+        if (!prismaClient) {
+          emitTerminalSSEError(res, 'Progressive endpoint requires req.prisma to be set')
+          return
+        }
         await runProgressiveEndpoint({
           req,
           res,
           ctx,
-          prisma: (req as ExtendedRequest).prisma,
+          prisma: prismaClient,
           variant: variant as string,
           stages: progressiveConfig.stages,
           stageRegistry,
@@ -679,6 +775,7 @@ ${writeOpBlocks}
     const path = basePath ? \`\${basePath}/each\` : '/each'
     router.post(
       path,
+      ...(opConfig.authorize ? [opConfig.authorize] : []),
       setShape(opConfig, 'noop'),
       ...opConfig.operationBefore,
       async (req: Request, res: Response, next: NextFunction) => {
@@ -707,4 +804,4 @@ ${writeOpBlocks}
   return router
 }
 `
-}
+}