prisma-generator-express 1.65.2 → 1.67.0

package/src/generators/generateRouterFastify.ts

@@ -1,8 +1,9 @@
-import { DMMF } from '@prisma/generator-helper'
+import type { DMMF } from '@prisma/generator-helper'
 import { generateRouteConfigType } from './generateRouteConfigType'
-import { ImportStyle } from '../utils/resolveImportStyle'
+import type { ImportStyle } from '../utils/resolveImportStyle'
 import { importExt } from '../utils/importExt'
-import { WriteStrategy, FindManyPaginatedMode } from '../constants'
+import type { WriteStrategy, FindManyPaginatedMode } from '../constants'
+import { modelPathSegment, type PathCase } from '../utils/pathCasing'
 import { OPERATION_METADATA } from '../copy/operationDefinitions'
 
 function pathExpr(suffix: string): string {
@@ -55,11 +56,11 @@ function emitReadOp(
 
   const postReadLine = meta.supportsPostRead
     ? meta.name === 'findMany'
-      ? `      if (postReadsEnabled) {
+      ? `      if (resolvePostReadsEnabled(config.disablePostReads, opConfig.disablePostReads)) {
         const postPath = basePath ? \`\${basePath}/read\` : '/read'
         instance.post(postPath, handleRead(opConfig, ${handlerName}, parseBodyAsQueryHook, '${opKind}'))
       }`
-      : `      if (postReadsEnabled) instance.post(path, handleRead(opConfig, ${handlerName}, parseBodyAsQueryHook, '${opKind}'))`
+      : `      if (resolvePostReadsEnabled(config.disablePostReads, opConfig.disablePostReads)) instance.post(path, handleRead(opConfig, ${handlerName}, parseBodyAsQueryHook, '${opKind}'))`
     : ''
 
   return `    if (isEnabled(config.${meta.configKey})) {
@@ -90,34 +91,41 @@ export function generateFastifyRouterFunction({
   model,
   enums,
   guardShapesImport,
+  clientImport,
   importStyle,
   writeStrategy,
   findManyPaginatedMode,
   dropGuard,
+  pathCase,
 }: {
   model: DMMF.Model
   enums: DMMF.DatamodelEnum[]
   guardShapesImport: string | null
+  clientImport?: string
   importStyle: ImportStyle
   writeStrategy: WriteStrategy
   findManyPaginatedMode: FindManyPaginatedMode
   dropGuard: boolean
+  pathCase: PathCase
 }): string {
   const ext = importExt(importStyle)
   const modelName = model.name
-  const modelNameLower = modelName.toLowerCase()
-  const routerFunctionName = `${modelName}Router`
+  const modelSegment = modelPathSegment(model.name, pathCase)
+  const routerFunctionName = `${model.name}Router`
 
-  const handlerImports = OPERATION_METADATA
-    .map((m) => `  ${modelName}${m.name.charAt(0).toUpperCase() + m.name.slice(1)},`)
-    .join('\n')
+  const handlerImports = OPERATION_METADATA.map(
+    (m) => `  ${modelName}${m.name.charAt(0).toUpperCase() + m.name.slice(1)},`,
+  ).join('\n')
 
   const readOps = OPERATION_METADATA.filter((m) => m.kind === 'read')
-  const writeOps = OPERATION_METADATA.filter((m) => m.kind === 'write' || m.kind === 'batch')
-    .filter((m) => m.name !== 'updateEach')
+  const writeOps = OPERATION_METADATA.filter(
+    (m) => m.kind === 'write' || m.kind === 'batch',
+  ).filter((m) => m.name !== 'updateEach')
 
   const readOpBlocks = readOps.map((m) => emitReadOp(m, modelName)).join('\n\n')
-  const writeOpBlocks = writeOps.map((m) => emitWriteOp(m, modelName)).join('\n\n')
+  const writeOpBlocks = writeOps
+    .map((m) => emitWriteOp(m, modelName))
+    .join('\n\n')
 
   return `import type { FastifyInstance, FastifyRequest, FastifyReply, FastifyError } from 'fastify'
 import { startQueryBuilder } from '../queryBuilder${ext}'
@@ -129,9 +137,11 @@ import type {
   FastifyHookHandler,
   FindManyPaginatedMode,
   PaginationConfig,
+  PrismaClientLike,
+  QueryBuilderConfig,
 } from '../routeConfig.target${ext}'
 import { parseQueryParams } from '../parseQueryParams${ext}'
-import { sanitizeKeys, normalizePrefix, getEnv, isPlainObject } from '../misc${ext}'
+import { sanitizeKeys, normalizePrefix, getEnv, isPlainObject, resolveDropGuardEnv } from '../misc${ext}'
 import { buildModelOpenApi } from '../buildModelOpenApi${ext}'
 import {
   normalizeOperation,
@@ -139,7 +149,10 @@ import {
   validateCountSourceWhere,
   validateOperationConfig,
   validateUpdateEachConfig,
+  resolvePostReadsEnabled,
+  warnIfUnguardedRoutes,
 } from '../routeConfig${ext}'
+import type { RuntimeOperationOverride } from '../operationRuntime${ext}'
 import type { NormalizedOperationConfig } from '../routeConfig${ext}'
 import type { OperationContext } from '../operationRuntime${ext}'
 import { transformResult } from '../operationRuntime${ext}'
@@ -151,13 +164,18 @@ import { applyDroppedGuard } from '../projectionDefaults${ext}'
 import type { OpKind } from '../projectionDefaults${ext}'
 import { MODEL_FIELDS, MODEL_ENUMS } from './${modelName}Metadata${ext}'
 
-${generateRouteConfigType(modelName, 'FastifyHookHandler', guardShapesImport, importStyle, 'fastify')}
+${generateRouteConfigType(modelName, 'FastifyHookHandler', guardShapesImport, importStyle, 'fastify', clientImport)}
 const _env = getEnv()
 
 const FIND_MANY_PAGINATED_MODE: FindManyPaginatedMode = '${findManyPaginatedMode}'
-const DROP_GUARD = ${dropGuard} || _env.E2E === 'true'
+// Fixed at generation time. The environment bypass is resolved per hook,
+// because it requires the configuration's explicit \`allowE2EGuardBypass: true\`:
+// false or omitted means the environment cannot drop guards for this target.
+const DROP_GUARD = ${dropGuard}
 
 type OperationConfigLike = {
+  authorize?: FastifyHookHandler
+  override?: RuntimeOperationOverride
   before?: FastifyHookHandler[]
   after?: FastifyHookHandler[]
   shape?: unknown
@@ -185,6 +203,8 @@ type FastifyExtended = FastifyRequest & {
   routeConfig?: { pagination?: PaginationConfig }
   guardShape?: Record<string, unknown>
   guardCaller?: string
+  operationOverride?: RuntimeOperationOverride
+  resolveOperationContext?: () => unknown | Promise<unknown>
   guardVariantKey?: string
   guardVariantFailure?: Extract<GuardVariantResolution, { ok: false }>
   resultData?: unknown
@@ -197,14 +217,14 @@ function normalizeFastifyOperation(
   return normalizeOperation<FastifyHookHandler, FastifyHookHandler>(config)
 }
 
-function isQueryBuilderEnabled(config: RouteConfig): boolean {
+function isQueryBuilderEnabled(config: { queryBuilder?: QueryBuilderConfig | false }): boolean {
   if (config.queryBuilder === false) return false
   if (typeof config.queryBuilder === 'object' && config.queryBuilder.enabled === false) return false
   if (_env.NODE_ENV === 'production') return false
   return true
 }
 
-function getQueryBuilderConfig(config: RouteConfig) {
+function getQueryBuilderConfig(config: { queryBuilder?: QueryBuilderConfig | false }) {
   if (config.queryBuilder === false) return null
   if (typeof config.queryBuilder === 'object') return config.queryBuilder
   return {}
@@ -225,21 +245,35 @@ function parseBodyAsQueryHook(request: FastifyRequest): void {
   (request as FastifyExtended).parsedQuery = sanitizeKeys(body as Record<string, unknown>)
 }
 
-function buildResolveContext(
-  config: ${modelName}RouteConfig,
+function buildResolveContext<TCtx, TPrisma extends PrismaClientLike>(
+  config: ${modelName}RouteConfig<TCtx, TPrisma>,
   request: FastifyRequest,
 ): (() => unknown | Promise<unknown>) | undefined {
   if (typeof config.resolveContext !== 'function') return undefined
   return () => (config.resolveContext as (r: FastifyRequest) => unknown | Promise<unknown>)(request)
 }
 
-function makeShapeHook(
-  config: ${modelName}RouteConfig,
+function makeShapeHook<TCtx, TPrisma extends PrismaClientLike>(
+  config: ${modelName}RouteConfig<TCtx, TPrisma>,
   opConfig: NormalizedOp,
   opKind: OpKind,
 ): (request: FastifyRequest) => Promise<void> {
+  /**
+   * The environment bypass, and it is OPT-IN for this target.
+   *
+   * \`PGE_DROP_GUARD=true\` (deprecated alias \`E2E=true\`) downgrading enforcement
+   * in a deployed environment is a real hazard: on most platforms it is an
+   * ordinary config var, set on staging, copied forward, flagged as
+   * security-relevant nowhere. It is honoured only when this configuration
+   * states \`allowE2EGuardBypass: true\` — false or omitted means the environment
+   * cannot drop guards. The generation-time \`DROP_GUARD\` literal is unchanged.
+   */
+  const dropGuard = DROP_GUARD || (config.allowE2EGuardBypass === true && resolveDropGuardEnv(_env))
   return async (request: FastifyRequest) => {
     const fx = request as FastifyExtended
+    fx.operationOverride = opConfig.override
+    let context: Promise<unknown> | undefined
+    fx.resolveOperationContext = () => context ??= Promise.resolve(config.resolveContext?.(request))
     const merged = mergePaginationConfig(config.pagination, opConfig.pagination)
     if (merged) fx.routeConfig = { pagination: merged }
 
@@ -263,7 +297,7 @@ function makeShapeHook(
     if (resolvedKey !== undefined) fx.guardVariantKey = resolvedKey
 
     if (opConfig.guardShape) {
-      if (!DROP_GUARD) {
+      if (!dropGuard) {
         fx.guardShape = opConfig.guardShape
       } else {
         await applyDroppedGuard(
@@ -322,7 +356,7 @@ function sendError(reply: FastifyReply, error: unknown): void {
   reply.code(httpError.status).send({ message: httpError.message })
 }
 
-export async function ${routerFunctionName}<TCtx = unknown, TPrisma = any>(
+export async function ${routerFunctionName}<TCtx = unknown, TPrisma extends PrismaClientLike = PrismaClientLike>(
   fastify: FastifyInstance,
   config: ${modelName}RouteConfig<TCtx, TPrisma> = {},
 ) {
@@ -334,6 +368,7 @@ export async function ${routerFunctionName}<TCtx = unknown, TPrisma = any>(
 
   await fastify.register(async (instance) => {
     const isEnabled = (value: unknown): boolean => value !== false && !!(config.enableAll || value)
+  warnIfUnguardedRoutes('${modelName}', ['findMany', 'findUnique', 'findUniqueOrThrow', 'findFirst', 'findFirstOrThrow', 'findManyPaginated', 'count', 'aggregate', 'groupBy', 'create', 'createMany', 'createManyAndReturn', 'update', 'updateMany', 'updateManyAndReturn', 'upsert', 'delete', 'deleteMany'], config, isEnabled)
 
     const opFor = (key: string): NormalizedOp => {
       const raw = (config as unknown as Record<string, unknown>)[key] as OperationConfigLike | undefined
@@ -342,7 +377,7 @@ export async function ${routerFunctionName}<TCtx = unknown, TPrisma = any>(
     }
 
     const customPrefix = normalizePrefix(config.customUrlPrefix || '')
-    const modelPrefix = config.addModelPrefix !== false ? '/${modelNameLower}' : ''
+    const modelPrefix = config.addModelPrefix !== false ? '/${modelSegment}' : ''
     const basePath = customPrefix + modelPrefix
 
     const openApiDisabled = config.disableOpenApi === true
@@ -351,7 +386,6 @@ export async function ${routerFunctionName}<TCtx = unknown, TPrisma = any>(
         || _env.DISABLE_OPENAPI === 'true'
       ))
 
-    const postReadsEnabled = !config.disablePostReads
 
     let _openApiJsonCache: unknown = undefined
     const getOpenApiJson = (): unknown => {
@@ -360,8 +394,8 @@ export async function ${routerFunctionName}<TCtx = unknown, TPrisma = any>(
           '${modelName}',
           MODEL_FIELDS as unknown as Parameters<typeof buildModelOpenApi>[1],
           MODEL_ENUMS as unknown as Parameters<typeof buildModelOpenApi>[2],
-          config,
-          { format: 'json', writeStrategy: '${writeStrategy}' },
+          config as unknown as Parameters<typeof buildModelOpenApi>[3],
+          { format: 'json', writeStrategy: '${writeStrategy}', pathSegment: '${modelSegment}' },
         )
       }
       return _openApiJsonCache
@@ -373,8 +407,8 @@ export async function ${routerFunctionName}<TCtx = unknown, TPrisma = any>(
           '${modelName}',
           MODEL_FIELDS as unknown as Parameters<typeof buildModelOpenApi>[1],
           MODEL_ENUMS as unknown as Parameters<typeof buildModelOpenApi>[2],
-          config,
-          { format: 'yaml', writeStrategy: '${writeStrategy}' },
+          config as unknown as Parameters<typeof buildModelOpenApi>[3],
+          { format: 'yaml', writeStrategy: '${writeStrategy}', pathSegment: '${modelSegment}' },
         ) as string
       }
       return _openApiYamlCache
@@ -424,6 +458,7 @@ export async function ${routerFunctionName}<TCtx = unknown, TPrisma = any>(
       opKind: OpKind,
     ) => async (request: FastifyRequest, reply: FastifyReply) => {
       try {
+        if (await runHooks(opConfig.authorize ? [opConfig.authorize] : [], request, reply)) return
         parseFn(request)
         await makeShapeHook(config, opConfig, opKind)(request)
         if (await runHooks(opConfig.operationBefore, request, reply)) return
@@ -456,6 +491,7 @@ export async function ${routerFunctionName}<TCtx = unknown, TPrisma = any>(
       opKind: OpKind,
     ) => async (request: FastifyRequest, reply: FastifyReply) => {
       try {
+        if (await runHooks(opConfig.authorize ? [opConfig.authorize] : [], request, reply)) return
         await makeShapeHook(config, opConfig, opKind)(request)
         if (await runHooks(opConfig.operationBefore, request, reply)) return
 
@@ -514,4 +550,4 @@ ${writeOpBlocks}
   })
 }
 `
-}
+}