prisma-generator-express 1.66.0 → 1.67.0

package/src/generators/generateRouterFastify.ts

@@ -1,8 +1,9 @@
-import { DMMF } from '@prisma/generator-helper'
+import type { DMMF } from '@prisma/generator-helper'
 import { generateRouteConfigType } from './generateRouteConfigType'
-import { ImportStyle } from '../utils/resolveImportStyle'
+import type { ImportStyle } from '../utils/resolveImportStyle'
 import { importExt } from '../utils/importExt'
-import { WriteStrategy, FindManyPaginatedMode } from '../constants'
+import type { WriteStrategy, FindManyPaginatedMode } from '../constants'
+import { modelPathSegment, type PathCase } from '../utils/pathCasing'
 import { OPERATION_METADATA } from '../copy/operationDefinitions'
 
 function pathExpr(suffix: string): string {
@@ -55,11 +56,11 @@ function emitReadOp(
 
   const postReadLine = meta.supportsPostRead
     ? meta.name === 'findMany'
-      ? `      if (postReadsEnabled) {
+      ? `      if (resolvePostReadsEnabled(config.disablePostReads, opConfig.disablePostReads)) {
         const postPath = basePath ? \`\${basePath}/read\` : '/read'
         instance.post(postPath, handleRead(opConfig, ${handlerName}, parseBodyAsQueryHook, '${opKind}'))
       }`
-      : `      if (postReadsEnabled) instance.post(path, handleRead(opConfig, ${handlerName}, parseBodyAsQueryHook, '${opKind}'))`
+      : `      if (resolvePostReadsEnabled(config.disablePostReads, opConfig.disablePostReads)) instance.post(path, handleRead(opConfig, ${handlerName}, parseBodyAsQueryHook, '${opKind}'))`
     : ''
 
   return `    if (isEnabled(config.${meta.configKey})) {
@@ -90,34 +91,41 @@ export function generateFastifyRouterFunction({
   model,
   enums,
   guardShapesImport,
+  clientImport,
   importStyle,
   writeStrategy,
   findManyPaginatedMode,
   dropGuard,
+  pathCase,
 }: {
   model: DMMF.Model
   enums: DMMF.DatamodelEnum[]
   guardShapesImport: string | null
+  clientImport?: string
   importStyle: ImportStyle
   writeStrategy: WriteStrategy
   findManyPaginatedMode: FindManyPaginatedMode
   dropGuard: boolean
+  pathCase: PathCase
 }): string {
   const ext = importExt(importStyle)
   const modelName = model.name
-  const modelNameLower = modelName.toLowerCase()
-  const routerFunctionName = `${modelName}Router`
+  const modelSegment = modelPathSegment(model.name, pathCase)
+  const routerFunctionName = `${model.name}Router`
 
-  const handlerImports = OPERATION_METADATA
-    .map((m) => `  ${modelName}${m.name.charAt(0).toUpperCase() + m.name.slice(1)},`)
-    .join('\n')
+  const handlerImports = OPERATION_METADATA.map(
+    (m) => `  ${modelName}${m.name.charAt(0).toUpperCase() + m.name.slice(1)},`,
+  ).join('\n')
 
   const readOps = OPERATION_METADATA.filter((m) => m.kind === 'read')
-  const writeOps = OPERATION_METADATA.filter((m) => m.kind === 'write' || m.kind === 'batch')
-    .filter((m) => m.name !== 'updateEach')
+  const writeOps = OPERATION_METADATA.filter(
+    (m) => m.kind === 'write' || m.kind === 'batch',
+  ).filter((m) => m.name !== 'updateEach')
 
   const readOpBlocks = readOps.map((m) => emitReadOp(m, modelName)).join('\n\n')
-  const writeOpBlocks = writeOps.map((m) => emitWriteOp(m, modelName)).join('\n\n')
+  const writeOpBlocks = writeOps
+    .map((m) => emitWriteOp(m, modelName))
+    .join('\n\n')
 
   return `import type { FastifyInstance, FastifyRequest, FastifyReply, FastifyError } from 'fastify'
 import { startQueryBuilder } from '../queryBuilder${ext}'
@@ -129,9 +137,11 @@ import type {
   FastifyHookHandler,
   FindManyPaginatedMode,
   PaginationConfig,
+  PrismaClientLike,
+  QueryBuilderConfig,
 } from '../routeConfig.target${ext}'
 import { parseQueryParams } from '../parseQueryParams${ext}'
-import { sanitizeKeys, normalizePrefix, getEnv, isPlainObject } from '../misc${ext}'
+import { sanitizeKeys, normalizePrefix, getEnv, isPlainObject, resolveDropGuardEnv } from '../misc${ext}'
 import { buildModelOpenApi } from '../buildModelOpenApi${ext}'
 import {
   normalizeOperation,
@@ -139,7 +149,10 @@ import {
   validateCountSourceWhere,
   validateOperationConfig,
   validateUpdateEachConfig,
+  resolvePostReadsEnabled,
+  warnIfUnguardedRoutes,
 } from '../routeConfig${ext}'
+import type { RuntimeOperationOverride } from '../operationRuntime${ext}'
 import type { NormalizedOperationConfig } from '../routeConfig${ext}'
 import type { OperationContext } from '../operationRuntime${ext}'
 import { transformResult } from '../operationRuntime${ext}'
@@ -151,13 +164,18 @@ import { applyDroppedGuard } from '../projectionDefaults${ext}'
 import type { OpKind } from '../projectionDefaults${ext}'
 import { MODEL_FIELDS, MODEL_ENUMS } from './${modelName}Metadata${ext}'
 
-${generateRouteConfigType(modelName, 'FastifyHookHandler', guardShapesImport, importStyle, 'fastify')}
+${generateRouteConfigType(modelName, 'FastifyHookHandler', guardShapesImport, importStyle, 'fastify', clientImport)}
 const _env = getEnv()
 
 const FIND_MANY_PAGINATED_MODE: FindManyPaginatedMode = '${findManyPaginatedMode}'
-const DROP_GUARD = ${dropGuard} || _env.E2E === 'true'
+// Fixed at generation time. The environment bypass is resolved per hook,
+// because it requires the configuration's explicit \`allowE2EGuardBypass: true\`:
+// false or omitted means the environment cannot drop guards for this target.
+const DROP_GUARD = ${dropGuard}
 
 type OperationConfigLike = {
+  authorize?: FastifyHookHandler
+  override?: RuntimeOperationOverride
   before?: FastifyHookHandler[]
   after?: FastifyHookHandler[]
   shape?: unknown
@@ -185,6 +203,8 @@ type FastifyExtended = FastifyRequest & {
   routeConfig?: { pagination?: PaginationConfig }
   guardShape?: Record<string, unknown>
   guardCaller?: string
+  operationOverride?: RuntimeOperationOverride
+  resolveOperationContext?: () => unknown | Promise<unknown>
   guardVariantKey?: string
   guardVariantFailure?: Extract<GuardVariantResolution, { ok: false }>
   resultData?: unknown
@@ -197,14 +217,14 @@ function normalizeFastifyOperation(
   return normalizeOperation<FastifyHookHandler, FastifyHookHandler>(config)
 }
 
-function isQueryBuilderEnabled(config: RouteConfig): boolean {
+function isQueryBuilderEnabled(config: { queryBuilder?: QueryBuilderConfig | false }): boolean {
   if (config.queryBuilder === false) return false
   if (typeof config.queryBuilder === 'object' && config.queryBuilder.enabled === false) return false
   if (_env.NODE_ENV === 'production') return false
   return true
 }
 
-function getQueryBuilderConfig(config: RouteConfig) {
+function getQueryBuilderConfig(config: { queryBuilder?: QueryBuilderConfig | false }) {
   if (config.queryBuilder === false) return null
   if (typeof config.queryBuilder === 'object') return config.queryBuilder
   return {}
@@ -225,21 +245,35 @@ function parseBodyAsQueryHook(request: FastifyRequest): void {
   (request as FastifyExtended).parsedQuery = sanitizeKeys(body as Record<string, unknown>)
 }
 
-function buildResolveContext(
-  config: ${modelName}RouteConfig,
+function buildResolveContext<TCtx, TPrisma extends PrismaClientLike>(
+  config: ${modelName}RouteConfig<TCtx, TPrisma>,
   request: FastifyRequest,
 ): (() => unknown | Promise<unknown>) | undefined {
   if (typeof config.resolveContext !== 'function') return undefined
   return () => (config.resolveContext as (r: FastifyRequest) => unknown | Promise<unknown>)(request)
 }
 
-function makeShapeHook(
-  config: ${modelName}RouteConfig,
+function makeShapeHook<TCtx, TPrisma extends PrismaClientLike>(
+  config: ${modelName}RouteConfig<TCtx, TPrisma>,
   opConfig: NormalizedOp,
   opKind: OpKind,
 ): (request: FastifyRequest) => Promise<void> {
+  /**
+   * The environment bypass, and it is OPT-IN for this target.
+   *
+   * \`PGE_DROP_GUARD=true\` (deprecated alias \`E2E=true\`) downgrading enforcement
+   * in a deployed environment is a real hazard: on most platforms it is an
+   * ordinary config var, set on staging, copied forward, flagged as
+   * security-relevant nowhere. It is honoured only when this configuration
+   * states \`allowE2EGuardBypass: true\` — false or omitted means the environment
+   * cannot drop guards. The generation-time \`DROP_GUARD\` literal is unchanged.
+   */
+  const dropGuard = DROP_GUARD || (config.allowE2EGuardBypass === true && resolveDropGuardEnv(_env))
   return async (request: FastifyRequest) => {
     const fx = request as FastifyExtended
+    fx.operationOverride = opConfig.override
+    let context: Promise<unknown> | undefined
+    fx.resolveOperationContext = () => context ??= Promise.resolve(config.resolveContext?.(request))
     const merged = mergePaginationConfig(config.pagination, opConfig.pagination)
     if (merged) fx.routeConfig = { pagination: merged }
 
@@ -263,7 +297,7 @@ function makeShapeHook(
     if (resolvedKey !== undefined) fx.guardVariantKey = resolvedKey
 
     if (opConfig.guardShape) {
-      if (!DROP_GUARD) {
+      if (!dropGuard) {
         fx.guardShape = opConfig.guardShape
       } else {
         await applyDroppedGuard(
@@ -322,7 +356,7 @@ function sendError(reply: FastifyReply, error: unknown): void {
   reply.code(httpError.status).send({ message: httpError.message })
 }
 
-export async function ${routerFunctionName}<TCtx = unknown, TPrisma = any>(
+export async function ${routerFunctionName}<TCtx = unknown, TPrisma extends PrismaClientLike = PrismaClientLike>(
   fastify: FastifyInstance,
   config: ${modelName}RouteConfig<TCtx, TPrisma> = {},
 ) {
@@ -334,6 +368,7 @@ export async function ${routerFunctionName}<TCtx = unknown, TPrisma = any>(
 
   await fastify.register(async (instance) => {
     const isEnabled = (value: unknown): boolean => value !== false && !!(config.enableAll || value)
+  warnIfUnguardedRoutes('${modelName}', ['findMany', 'findUnique', 'findUniqueOrThrow', 'findFirst', 'findFirstOrThrow', 'findManyPaginated', 'count', 'aggregate', 'groupBy', 'create', 'createMany', 'createManyAndReturn', 'update', 'updateMany', 'updateManyAndReturn', 'upsert', 'delete', 'deleteMany'], config, isEnabled)
 
     const opFor = (key: string): NormalizedOp => {
       const raw = (config as unknown as Record<string, unknown>)[key] as OperationConfigLike | undefined
@@ -342,7 +377,7 @@ export async function ${routerFunctionName}<TCtx = unknown, TPrisma = any>(
     }
 
     const customPrefix = normalizePrefix(config.customUrlPrefix || '')
-    const modelPrefix = config.addModelPrefix !== false ? '/${modelNameLower}' : ''
+    const modelPrefix = config.addModelPrefix !== false ? '/${modelSegment}' : ''
     const basePath = customPrefix + modelPrefix
 
     const openApiDisabled = config.disableOpenApi === true
@@ -351,7 +386,6 @@ export async function ${routerFunctionName}<TCtx = unknown, TPrisma = any>(
         || _env.DISABLE_OPENAPI === 'true'
       ))
 
-    const postReadsEnabled = !config.disablePostReads
 
     let _openApiJsonCache: unknown = undefined
     const getOpenApiJson = (): unknown => {
@@ -360,8 +394,8 @@ export async function ${routerFunctionName}<TCtx = unknown, TPrisma = any>(
           '${modelName}',
           MODEL_FIELDS as unknown as Parameters<typeof buildModelOpenApi>[1],
           MODEL_ENUMS as unknown as Parameters<typeof buildModelOpenApi>[2],
-          config,
-          { format: 'json', writeStrategy: '${writeStrategy}' },
+          config as unknown as Parameters<typeof buildModelOpenApi>[3],
+          { format: 'json', writeStrategy: '${writeStrategy}', pathSegment: '${modelSegment}' },
         )
       }
       return _openApiJsonCache
@@ -373,8 +407,8 @@ export async function ${routerFunctionName}<TCtx = unknown, TPrisma = any>(
           '${modelName}',
           MODEL_FIELDS as unknown as Parameters<typeof buildModelOpenApi>[1],
           MODEL_ENUMS as unknown as Parameters<typeof buildModelOpenApi>[2],
-          config,
-          { format: 'yaml', writeStrategy: '${writeStrategy}' },
+          config as unknown as Parameters<typeof buildModelOpenApi>[3],
+          { format: 'yaml', writeStrategy: '${writeStrategy}', pathSegment: '${modelSegment}' },
         ) as string
       }
       return _openApiYamlCache
@@ -424,6 +458,7 @@ export async function ${routerFunctionName}<TCtx = unknown, TPrisma = any>(
       opKind: OpKind,
     ) => async (request: FastifyRequest, reply: FastifyReply) => {
       try {
+        if (await runHooks(opConfig.authorize ? [opConfig.authorize] : [], request, reply)) return
         parseFn(request)
         await makeShapeHook(config, opConfig, opKind)(request)
         if (await runHooks(opConfig.operationBefore, request, reply)) return
@@ -456,6 +491,7 @@ export async function ${routerFunctionName}<TCtx = unknown, TPrisma = any>(
       opKind: OpKind,
     ) => async (request: FastifyRequest, reply: FastifyReply) => {
       try {
+        if (await runHooks(opConfig.authorize ? [opConfig.authorize] : [], request, reply)) return
         await makeShapeHook(config, opConfig, opKind)(request)
         if (await runHooks(opConfig.operationBefore, request, reply)) return
 
@@ -514,4 +550,4 @@ ${writeOpBlocks}
   })
 }
 `
-}
+}

package/src/generators/generateRouterHono.ts

@@ -1,8 +1,9 @@
-import { DMMF } from '@prisma/generator-helper'
+import type { DMMF } from '@prisma/generator-helper'
 import { generateRouteConfigType } from './generateRouteConfigType'
-import { ImportStyle } from '../utils/resolveImportStyle'
+import type { ImportStyle } from '../utils/resolveImportStyle'
 import { importExt } from '../utils/importExt'
-import { WriteStrategy } from '../constants'
+import type { WriteStrategy } from '../constants'
+import { modelPathSegment, type PathCase } from '../utils/pathCasing'
 import { OPERATION_METADATA } from '../copy/operationDefinitions'
 
 function pathExpr(suffix: string): string {
@@ -44,7 +45,10 @@ function opKindFor(opName: string): string {
   }
 }
 
-function emitReadOp(meta: (typeof OPERATION_METADATA)[number], modelName: string): string {
+function emitReadOp(
+  meta: (typeof OPERATION_METADATA)[number],
+  modelName: string,
+): string {
   const c = meta.name.charAt(0).toUpperCase() + meta.name.slice(1)
   const handlerName = `${modelName}${c}`
   const pathValue = pathExpr(meta.pathSuffix)
@@ -52,11 +56,11 @@ function emitReadOp(meta: (typeof OPERATION_METADATA)[number], modelName: string
 
   const postReadLine = meta.supportsPostRead
     ? meta.name === 'findMany'
-      ? `    if (postReadsEnabled) {
+      ? `    if (resolvePostReadsEnabled(config.disablePostReads, opConfig.disablePostReads)) {
       const postPath = basePath ? \`\${basePath}/read\` : '/read'
       app.post(postPath, handleRead(opConfig, ${handlerName}, parseBodyAsQueryMiddleware, '${opKind}'))
     }`
-      : `    if (postReadsEnabled) app.post(path, handleRead(opConfig, ${handlerName}, parseBodyAsQueryMiddleware, '${opKind}'))`
+      : `    if (resolvePostReadsEnabled(config.disablePostReads, opConfig.disablePostReads)) app.post(path, handleRead(opConfig, ${handlerName}, parseBodyAsQueryMiddleware, '${opKind}'))`
     : ''
 
   return `  if (isEnabled(config.${meta.configKey})) {
@@ -67,7 +71,10 @@ ${postReadLine}
   }`
 }
 
-function emitWriteOp(meta: (typeof OPERATION_METADATA)[number], modelName: string): string {
+function emitWriteOp(
+  meta: (typeof OPERATION_METADATA)[number],
+  modelName: string,
+): string {
   const c = meta.name.charAt(0).toUpperCase() + meta.name.slice(1)
   const handlerName = `${modelName}${c}`
   const pathValue = pathExpr(meta.pathSuffix)
@@ -96,7 +103,7 @@ function emitWriteOp(meta: (typeof OPERATION_METADATA)[number], modelName: strin
  *   - `requireDefaultVariantOptIn`  confirm a `default` variant
  *   - `enableUpdateEach`            register the batch route (default true)
  *   - `guardResolutionOrder`        settle the guard before or after hooks
- *   - `allowE2EGuardBypass`         honour E2E=true (default true)
+ *   - `allowE2EGuardBypass`         honour PGE_DROP_GUARD=true (default true)
  *   - `validateResolvedShapes`      check what a shape function returned
  *
  * `HARDENED_GUARD_PROFILE` selects all seven, as values to spread rather than a
@@ -106,7 +113,10 @@ function emitWriteOp(meta: (typeof OPERATION_METADATA)[number], modelName: strin
  *
  * The emitted router used to compute `DROP_GUARD = <flag> || _env.E2E === 'true'`,
  * so setting `E2E=true` in a deployed environment downgraded enforcement even
- * when the generator had been told to keep the guard. The two modes are not
+ * when the generator had been told to keep the guard. The bypass now lives once
+ * in the shared runtime as `resolveDropGuardEnv`: it honours `PGE_DROP_GUARD=true`
+ * and keeps `E2E=true` working as a deprecated alias with a one-time warning.
+ * The two modes are not
  * equivalent: with the guard, the shape goes to prisma-guard; with it dropped,
  * `applyDroppedGuard` applies projection defaults and forced `where` clauses and
  * nothing else is validated against the shape.
@@ -133,32 +143,39 @@ export function generateHonoRouterFunction({
   model,
   enums,
   guardShapesImport,
+  clientImport,
   importStyle,
   writeStrategy,
   dropGuard,
+  pathCase,
 }: {
   model: DMMF.Model
   enums: DMMF.DatamodelEnum[]
   guardShapesImport: string | null
+  clientImport?: string
   importStyle: ImportStyle
   writeStrategy: WriteStrategy
   dropGuard: boolean
+  pathCase: PathCase
 }): string {
   const ext = importExt(importStyle)
   const modelName = model.name
-  const modelNameLower = modelName.toLowerCase()
+  const modelSegment = modelPathSegment(modelName, pathCase)
   const routerFunctionName = `${modelName}Router`
 
-  const handlerImports = OPERATION_METADATA
-    .map((m) => `  ${modelName}${m.name.charAt(0).toUpperCase() + m.name.slice(1)},`)
-    .join('\n')
+  const handlerImports = OPERATION_METADATA.map(
+    (m) => `  ${modelName}${m.name.charAt(0).toUpperCase() + m.name.slice(1)},`,
+  ).join('\n')
 
   const readOps = OPERATION_METADATA.filter((m) => m.kind === 'read')
-  const writeOps = OPERATION_METADATA.filter((m) => m.kind === 'write' || m.kind === 'batch')
-    .filter((m) => m.name !== 'updateEach')
+  const writeOps = OPERATION_METADATA.filter(
+    (m) => m.kind === 'write' || m.kind === 'batch',
+  ).filter((m) => m.name !== 'updateEach')
 
   const readOpBlocks = readOps.map((m) => emitReadOp(m, modelName)).join('\n\n')
-  const writeOpBlocks = writeOps.map((m) => emitWriteOp(m, modelName)).join('\n\n')
+  const writeOpBlocks = writeOps
+    .map((m) => emitWriteOp(m, modelName))
+    .join('\n\n')
 
   return `import { Hono } from 'hono'
 import type { Context } from 'hono'
@@ -175,9 +192,10 @@ import type {
   HonoInternalVariables,
   GeneratedHonoEnv,
   PaginationConfig,
+  PrismaClientLike,
 } from '../routeConfig.target${ext}'
 import { parseQueryParams } from '../parseQueryParams${ext}'
-import { normalizePrefix, getEnv, sanitizeKeys, isPlainObject } from '../misc${ext}'
+import { normalizePrefix, getEnv, sanitizeKeys, isPlainObject, resolveDropGuardEnv } from '../misc${ext}'
 import { buildModelOpenApi } from '../buildModelOpenApi${ext}'
 import {
   normalizeOperation,
@@ -187,7 +205,10 @@ import {
   validateCountSourceWhere,
   validateOperationConfig,
   validateUpdateEachConfig,
+  resolvePostReadsEnabled,
+  warnIfUnguardedRoutes,
 } from '../routeConfig${ext}'
+import type { RuntimeOperationOverride } from '../operationRuntime${ext}'
 import type { NormalizedOperationConfig } from '../routeConfig${ext}'
 import { transformResult } from '../operationRuntime${ext}'
 import { mapError } from '../errorMapper${ext}'
@@ -197,7 +218,7 @@ import { applyDroppedGuard } from '../projectionDefaults${ext}'
 import type { OpKind } from '../projectionDefaults${ext}'
 import { MODEL_FIELDS, MODEL_ENUMS } from './${modelName}Metadata${ext}'
 
-${generateRouteConfigType(modelName, 'HonoBeforeHook', guardShapesImport, importStyle, 'hono')}
+${generateRouteConfigType(modelName, 'HonoBeforeHook', guardShapesImport, importStyle, 'hono', clientImport)}
 const _env = getEnv()
 
 // Fixed at generation time. The \`allowE2EGuardBypass\` control decides whether the
@@ -216,6 +237,8 @@ const DROP_GUARD = ${dropGuard}
 type JsonLike = string | number | boolean | null | unknown[] | Record<string, unknown>
 
 type OperationConfigLike<TEnv extends HonoEnvBase> = {
+  authorize?: HonoBeforeHook<TEnv>
+  override?: RuntimeOperationOverride
   before?: HonoBeforeHook<TEnv>[]
   after?: HonoAfterHook<TEnv>[]
   shape?: unknown
@@ -289,7 +312,7 @@ async function parseWriteBodyMiddleware(c: HandlerContext): Promise<void> {
   c.set('body', body)
 }
 
-function makeShapeMiddleware<TCtx, TPrisma, TEnv extends HonoEnvBase>(
+function makeShapeMiddleware<TCtx, TPrisma extends PrismaClientLike, TEnv extends HonoEnvBase>(
   config: ${modelName}RouteConfig<TCtx, TPrisma, TEnv>,
   opConfig: NormalizedOp<TEnv>,
   opKind: OpKind,
@@ -299,11 +322,11 @@ function makeShapeMiddleware<TCtx, TPrisma, TEnv extends HonoEnvBase>(
   /**
    * The environment bypass, honoured unless the consumer turned it off.
    *
-   * \`E2E=true\` downgrading enforcement in a deployed environment is a real
-   * hazard, and it is also upstream behaviour — so it is a control, not a
-   * decision made here.
+   * \`PGE_DROP_GUARD=true\` downgrading enforcement in a deployed environment is
+   * a real hazard, and it is also upstream behaviour (under its deprecated
+   * \`E2E=true\` spelling) — so it is a control, not a decision made here.
    */
-  const dropGuard = DROP_GUARD || (policy.allowE2EGuardBypass && _env.E2E === 'true')
+  const dropGuard = DROP_GUARD || (policy.allowE2EGuardBypass && resolveDropGuardEnv(_env))
 
   return async (c: Context<GeneratedHonoEnv<TEnv>>): Promise<void> => {
     /**
@@ -318,6 +341,9 @@ function makeShapeMiddleware<TCtx, TPrisma, TEnv extends HonoEnvBase>(
      * in.
      */
     const vars = c as unknown as HandlerContext
+    vars.set('operationOverride', opConfig.override)
+    let context: Promise<unknown> | undefined
+    vars.set('resolveOperationContext', () => context ??= Promise.resolve(config.resolveContext?.(c)))
 
     const merged = mergePaginationConfig(config.pagination, opConfig.pagination)
     if (merged) vars.set('routeConfig', { pagination: merged })
@@ -341,7 +367,7 @@ function makeShapeMiddleware<TCtx, TPrisma, TEnv extends HonoEnvBase>(
 
     if (opConfig.guardShape) {
       const resolveCtx = typeof config.resolveContext === 'function'
-        ? () => (config.resolveContext as unknown as (ctx: Context<GeneratedHonoEnv<TEnv>>) => unknown | Promise<unknown>)(c)
+        ? vars.get('resolveOperationContext')
         : undefined
 
       /**
@@ -441,7 +467,7 @@ function sendError(c: HandlerContext, error: unknown): Response {
   return c.json({ message: httpError.message }, httpError.status as ContentfulStatusCode)
 }
 
-export function ${routerFunctionName}<TCtx = unknown, TPrisma = any, TEnv extends HonoEnvBase = HonoEnvBase>(config: ${modelName}RouteConfig<TCtx, TPrisma, TEnv> = {}): Hono<GeneratedHonoEnv<TEnv>> {
+export function ${routerFunctionName}<TCtx = unknown, TPrisma extends PrismaClientLike = PrismaClientLike, TEnv extends HonoEnvBase = HonoEnvBase>(config: ${modelName}RouteConfig<TCtx, TPrisma, TEnv> = {}): Hono<GeneratedHonoEnv<TEnv>> {
   validateCountSourceWhere(config.pagination?.countSource, '${modelName} pagination')
   validateCountSourceWhere(
     (config.findManyPaginated && typeof config.findManyPaginated === 'object' ? config.findManyPaginated : undefined)?.pagination?.countSource,
@@ -451,9 +477,10 @@ export function ${routerFunctionName}<TCtx = unknown, TPrisma = any, TEnv extend
   const app = new Hono<GeneratedHonoEnv<TEnv>>()
 
   const isEnabled = (value: unknown): boolean => value !== false && !!(config.enableAll || value)
+  warnIfUnguardedRoutes('${modelName}', ['findMany', 'findUnique', 'findUniqueOrThrow', 'findFirst', 'findFirstOrThrow', 'findManyPaginated', 'count', 'aggregate', 'groupBy', 'create', 'createMany', 'createManyAndReturn', 'update', 'updateMany', 'updateManyAndReturn', 'upsert', 'delete', 'deleteMany'], config, isEnabled)
 
   const customPrefix = normalizePrefix(config.customUrlPrefix || '')
-  const modelPrefix = config.addModelPrefix !== false ? '/${modelNameLower}' : ''
+    const modelPrefix = config.addModelPrefix !== false ? '/${modelSegment}' : ''
   const basePath = customPrefix + modelPrefix
 
   const openApiDisabled = config.disableOpenApi === true
@@ -462,7 +489,6 @@ export function ${routerFunctionName}<TCtx = unknown, TPrisma = any, TEnv extend
       || _env.DISABLE_OPENAPI === 'true'
     ))
 
-  const postReadsEnabled = !config.disablePostReads
 
   let _openApiJsonCache: unknown = undefined
   const getOpenApiJson = (): unknown => {
@@ -472,7 +498,7 @@ export function ${routerFunctionName}<TCtx = unknown, TPrisma = any, TEnv extend
         MODEL_FIELDS as unknown as Parameters<typeof buildModelOpenApi>[1],
         MODEL_ENUMS as unknown as Parameters<typeof buildModelOpenApi>[2],
         config as unknown as Parameters<typeof buildModelOpenApi>[3],
-        { format: 'json', writeStrategy: '${writeStrategy}' },
+        { format: 'json', writeStrategy: '${writeStrategy}', pathSegment: '${modelSegment}' },
       )
     }
     return _openApiJsonCache
@@ -485,7 +511,7 @@ export function ${routerFunctionName}<TCtx = unknown, TPrisma = any, TEnv extend
         MODEL_FIELDS as unknown as Parameters<typeof buildModelOpenApi>[1],
         MODEL_ENUMS as unknown as Parameters<typeof buildModelOpenApi>[2],
         config as unknown as Parameters<typeof buildModelOpenApi>[3],
-        { format: 'yaml', writeStrategy: '${writeStrategy}' },
+        { format: 'yaml', writeStrategy: '${writeStrategy}', pathSegment: '${modelSegment}' },
       ) as string
     }
     return _openApiYamlCache
@@ -552,6 +578,8 @@ export function ${routerFunctionName}<TCtx = unknown, TPrisma = any, TEnv extend
     opKind: OpKind,
   ) => async (c: Context<GeneratedHonoEnv<TEnv>>): Promise<Response> => {
     try {
+      const authorized = await runBeforeHooks<TEnv>(opConfig.authorize ? [opConfig.authorize] : [], c)
+      if (authorized) return authorized
       await parseFn(c as unknown as HandlerContext)
       await makeShapeMiddleware<TCtx, TPrisma, TEnv>(config, opConfig, opKind)(c)
 
@@ -587,6 +615,8 @@ export function ${routerFunctionName}<TCtx = unknown, TPrisma = any, TEnv extend
     opKind: OpKind,
   ) => async (c: Context<GeneratedHonoEnv<TEnv>>): Promise<Response> => {
     try {
+      const authorized = await runBeforeHooks<TEnv>(opConfig.authorize ? [opConfig.authorize] : [], c)
+      if (authorized) return authorized
       await parseWriteBodyMiddleware(c as unknown as HandlerContext)
       await makeShapeMiddleware<TCtx, TPrisma, TEnv>(config, opConfig, opKind)(c)
 
@@ -677,4 +707,4 @@ ${writeOpBlocks}
   return app
 }
 `
-}
+}

package/src/generators/generateUnifiedDocs.ts

@@ -4,18 +4,21 @@ import type { Target } from '../constants'
 
 export function generateUnifiedDocs(
   modelNames: string[],
+  pathSegments: Record<string, string>,
   target: Target,
   importStyle: ImportStyle,
 ): string {
   const ext = importExt(importStyle)
-  if (target === 'fastify') return generateFastify(modelNames, ext)
-  if (target === 'hono') return generateHono(modelNames, ext)
-  return generateExpress(modelNames, ext)
+  if (target === 'fastify')
+    return generateFastify(modelNames, pathSegments, ext)
+  if (target === 'hono') return generateHono(modelNames, pathSegments, ext)
+  return generateExpress(modelNames, pathSegments, ext)
 }
 
 const renderIndexFn = `function renderIndex(title: string, modelNames: string[], basePath: string): string {
+  const segments = MODEL_PATH_SEGMENTS as Record<string, string>
   const links = modelNames
-    .map((n) => '<li><a href="' + basePath + '/' + n.toLowerCase() + '">' + n + '</a></li>')
+    .map((n) => '<li><a href="' + basePath + '/' + (segments[n] ?? n.toLowerCase()) + '">' + n + '</a></li>')
     .join('')
 
   return '<!DOCTYPE html><html><head><meta charset="utf-8" /><title>' + title +
@@ -27,7 +30,11 @@ const renderIndexFn = `function renderIndex(title: string, modelNames: string[],
     '</div></body></html>'
 }`
 
-function generateExpress(modelNames: string[], ext: string): string {
+function generateExpress(
+  modelNames: string[],
+  pathSegments: Record<string, string>,
+  ext: string,
+): string {
   return `import type { Router } from 'express'
 import { getEnv, removeTrailingSlash } from './misc${ext}'
 
@@ -35,6 +42,8 @@ const _env = getEnv()
 
 const MODELS = ${JSON.stringify(modelNames)} as const
 
+const MODEL_PATH_SEGMENTS = ${JSON.stringify(pathSegments)} as const
+
 interface UnifiedDocsConfig {
   title?: string
   basePath?: string
@@ -62,7 +71,11 @@ export default registerUnifiedDocs
 `
 }
 
-function generateFastify(modelNames: string[], ext: string): string {
+function generateFastify(
+  modelNames: string[],
+  pathSegments: Record<string, string>,
+  ext: string,
+): string {
   return `import type { FastifyInstance } from 'fastify'
 import { getEnv, removeTrailingSlash } from './misc${ext}'
 
@@ -70,6 +83,8 @@ const _env = getEnv()
 
 const MODELS = ${JSON.stringify(modelNames)} as const
 
+const MODEL_PATH_SEGMENTS = ${JSON.stringify(pathSegments)} as const
+
 interface UnifiedDocsConfig {
   title?: string
   basePath?: string
@@ -100,7 +115,11 @@ export default registerUnifiedDocs
 `
 }
 
-function generateHono(modelNames: string[], ext: string): string {
+function generateHono(
+  modelNames: string[],
+  pathSegments: Record<string, string>,
+  ext: string,
+): string {
   return `import type { Hono } from 'hono'
 import { getEnv, removeTrailingSlash } from './misc${ext}'
 
@@ -108,6 +127,8 @@ const _env = getEnv()
 
 const MODELS = ${JSON.stringify(modelNames)} as const
 
+const MODEL_PATH_SEGMENTS = ${JSON.stringify(pathSegments)} as const
+
 interface UnifiedDocsConfig {
   title?: string
   basePath?: string
@@ -133,4 +154,4 @@ ${renderIndexFn}
 
 export default registerUnifiedDocs
 `
-}
+}