prisma-generator-express 1.66.0 → 1.68.0

package/src/generators/generateRouter.ts

@@ -1,8 +1,9 @@
-import { DMMF } from '@prisma/generator-helper'
+import type { DMMF } from '@prisma/generator-helper'
 import { generateRouteConfigType } from './generateRouteConfigType'
-import { ImportStyle } from '../utils/resolveImportStyle'
+import type { ImportStyle } from '../utils/resolveImportStyle'
 import { importExt } from '../utils/importExt'
-import { WriteStrategy, FindManyPaginatedMode } from '../constants'
+import type { WriteStrategy, FindManyPaginatedMode } from '../constants'
+import { modelPathSegment, type PathCase } from '../utils/pathCasing'
 import { OPERATION_METADATA } from '../copy/operationDefinitions'
 
 function pathExpr(basePath: string, suffix: string): string {
@@ -55,10 +56,11 @@ function emitReadOp(
   const opKind = opKindFor(meta.name)
 
   const postReadBlock = meta.supportsPostRead
-    ? `    if (postReadsEnabled) {
+    ? `    if (resolvePostReadsEnabled(config.disablePostReads, opConfig.disablePostReads)) {
       const postPath = ${meta.name === 'findMany' ? "basePath ? `${basePath}/read` : '/read'" : `path`}
       router.post(
         postPath,
+        ...(opConfig.authorize ? [opConfig.authorize] : []),
         parseBodyAsQuery,
         setShape(opConfig, '${opKind}'),
         ...opConfig.operationBefore,
@@ -77,12 +79,14 @@ function emitReadOp(
     const path = ${pathValue}
     router.get(
       path,
+      ...(opConfig.authorize ? [opConfig.authorize] : []),
       parseQuery,
       setShape(opConfig, '${opKind}'),
       ...opConfig.operationBefore,
       requireVariantKey(),
       variantBeforeDispatcher(opConfig),
       maybeProgressiveSSE(opConfig, core.${meta.coreName}, '${meta.name}'),
+      ${meta.name === 'findMany' ? 'maybeNdjsonFindMany(core.findMany),' : ''}
       ${handlerName} as RequestHandler,
       variantAfterDispatcher(opConfig),
       ...opConfig.operationAfter,
@@ -107,6 +111,7 @@ function emitWriteOp(
     const path = ${pathValue}
     router.${meta.method}(
       path,
+      ...(opConfig.authorize ? [opConfig.authorize] : []),
       setShape(opConfig, '${opKind}'),
       ...opConfig.operationBefore,
       requireVariantKey(),
@@ -123,22 +128,26 @@ export function generateRouterFunction({
   model,
   enums,
   guardShapesImport,
+  clientImport,
   importStyle,
   writeStrategy,
   findManyPaginatedMode,
   dropGuard,
+  pathCase,
 }: {
   model: DMMF.Model
   enums: DMMF.DatamodelEnum[]
   guardShapesImport: string | null
+  clientImport?: string
   importStyle: ImportStyle
   writeStrategy: WriteStrategy
   findManyPaginatedMode: FindManyPaginatedMode
   dropGuard: boolean
+  pathCase: PathCase
 }): string {
   const ext = importExt(importStyle)
   const modelName = model.name
-  const modelNameLower = modelName.toLowerCase()
+  const modelSegment = modelPathSegment(modelName, pathCase)
   const delegateKey = modelName.charAt(0).toLowerCase() + modelName.slice(1)
   const routerFunctionName = `${modelName}Router`
 
@@ -173,24 +182,34 @@ import type {
   QueryBuilderConfig,
   FindManyPaginatedMode,
   PaginationConfig,
+  PrismaClientLike,
 } from '../routeConfig.target${ext}'
 import { parseQueryParams } from '../parseQueryParams${ext}'
-import { sanitizeKeys, normalizePrefix, getEnv, isPlainObject } from '../misc${ext}'
+import { sanitizeKeys, normalizePrefix, getEnv, isPlainObject, resolveDropGuardEnv } from '../misc${ext}'
 import { buildModelOpenApi } from '../buildModelOpenApi${ext}'
 import {
   normalizeOperation,
-  resolveOperationVariantKey,
   validateCountSourceWhere,
   validateOperationConfig,
   validateUpdateEachConfig,
+  resolvePostReadsEnabled,
+  warnIfUnguardedRoutes,
 } from '../routeConfig${ext}'
+import type { RuntimeOperationOverride } from '../operationRuntime${ext}'
 import type { NormalizedOperationConfig } from '../routeConfig${ext}'
 import type { OperationContext } from '../operationRuntime${ext}'
 import { transformResult } from '../operationRuntime${ext}'
 import { HttpError, mapError } from '../errorMapper${ext}'
-import { formatGuardVariantResolutionError } from '../guardVariantError${ext}'
-import type { GuardVariantResolution } from '../guardVariantRouting${ext}'
+import {
+  routeOperation,
+  prepareGuardOperation,
+  settleStage,
+  classifyError,
+  memoizeContext,
+  type ArgsChannel,
+} from '../operationPipeline${ext}'
 import { mergePaginationConfig } from '../pagination${ext}'
+import { acceptsNdjson, runNdjsonFindMany } from '../ndjson${ext}'
 import {
   acceptsEventStream,
   runProgressiveEndpoint,
@@ -200,17 +219,21 @@ import {
 } from '../sse${ext}'
 import { relationModels } from '../relationModels${ext}'
 import { runAutoIncludeProgressive } from '../autoIncludeRuntime${ext}'
-import { applyDroppedGuard } from '../projectionDefaults${ext}'
 import type { OpKind } from '../projectionDefaults${ext}'
 import { MODEL_FIELDS, MODEL_ENUMS } from './${modelName}Metadata${ext}'
 
-${generateRouteConfigType(modelName, 'RequestHandler', guardShapesImport, importStyle, 'express')}
+${generateRouteConfigType(modelName, 'RequestHandler', guardShapesImport, importStyle, 'express', clientImport)}
 const _env = getEnv()
 
 const FIND_MANY_PAGINATED_MODE: FindManyPaginatedMode = '${findManyPaginatedMode}'
-const DROP_GUARD = ${dropGuard} || _env.E2E === 'true'
+// Fixed at generation time. The environment bypass is resolved per router,
+// because it requires the configuration's explicit \`allowE2EGuardBypass: true\`:
+// false or omitted means the environment cannot drop guards for this target.
+const DROP_GUARD = ${dropGuard}
 
 type OperationConfigLike = {
+  authorize?: RequestHandler
+  override?: RuntimeOperationOverride
   before?: RequestHandler[]
   after?: RequestHandler[]
   shape?: unknown
@@ -233,7 +256,7 @@ type NormalizedOp = NormalizedOperationConfig<RequestHandler, RequestHandler> &
 }
 
 type ExtendedRequest = Request & {
-  prisma?: unknown
+  prisma?: PrismaClientLike
   postgres?: unknown
   sqlite?: unknown
 }
@@ -243,11 +266,35 @@ type LocalsBag = {
   routeConfig?: { pagination?: PaginationConfig }
   guardShape?: Record<string, unknown>
   guardCaller?: string
+  operationOverride?: RuntimeOperationOverride
+  getContext?: () => Promise<unknown>
   guardVariantKey?: string
-  guardVariantFailure?: Extract<GuardVariantResolution, { ok: false }>
+  routeFailure?: { ok: false; failure: HttpError }
+  guardFailure?: { ok: false; failure: HttpError }
   data?: unknown
 }
 
+function queryChannel(res: Response): ArgsChannel {
+  return {
+    read: () => readLocals(res).parsedQuery,
+    write: (next) => {
+      readLocals(res).parsedQuery = next
+    },
+  }
+}
+
+function bodyChannel(req: Request): ArgsChannel {
+  return {
+    read: () =>
+      isPlainObject(req.body)
+        ? (req.body as Record<string, unknown>)
+        : undefined,
+    write: (next) => {
+      req.body = next
+    },
+  }
+}
+
 function normalizeExpressOperation(
   config: OperationConfigLike | undefined,
 ): NormalizedOp {
@@ -351,16 +398,19 @@ function variantAfterDispatcher(opConfig: NormalizedOp): RequestHandler {
 
 function requireVariantKey(): RequestHandler {
   return (_req, res, next) => {
-    const failure = readLocals(res).guardVariantFailure
-    if (!failure) {
-      next()
+    const locals = readLocals(res)
+    try {
+      if (locals.routeFailure) settleStage(locals.routeFailure)
+      if (locals.guardFailure) settleStage(locals.guardFailure)
+    } catch (err) {
+      next(err)
       return
     }
-    next(new HttpError(400, formatGuardVariantResolutionError(failure)))
+    next()
   }
 }
 
-export function ${routerFunctionName}<TCtx = unknown, TPrisma = any>(config: ${modelName}RouteConfig<TCtx, TPrisma> = {}) {
+export function ${routerFunctionName}<TCtx = unknown, TPrisma extends PrismaClientLike = PrismaClientLike>(config: ${modelName}RouteConfig<TCtx, TPrisma> = {}) {
   validateCountSourceWhere(config.pagination?.countSource, '${modelName} pagination')
   validateCountSourceWhere(
     (config.findManyPaginated && typeof config.findManyPaginated === 'object' ? config.findManyPaginated : undefined)?.pagination?.countSource,
@@ -370,6 +420,7 @@ export function ${routerFunctionName}<TCtx = unknown, TPrisma = any>(config: ${m
   const router = express.Router()
 
   const isEnabled = (value: unknown): boolean => value !== false && !!(config.enableAll || value)
+  warnIfUnguardedRoutes('${modelName}', ['findMany', 'findUnique', 'findUniqueOrThrow', 'findFirst', 'findFirstOrThrow', 'findManyPaginated', 'count', 'aggregate', 'groupBy', 'create', 'createMany', 'createManyAndReturn', 'update', 'updateMany', 'updateManyAndReturn', 'upsert', 'delete', 'deleteMany'], config, isEnabled)
 
   const opFor = (key: string): NormalizedOp => {
     const raw = (config as unknown as Record<string, unknown>)[key] as OperationConfigLike | undefined
@@ -378,13 +429,12 @@ export function ${routerFunctionName}<TCtx = unknown, TPrisma = any>(config: ${m
   }
 
   const customPrefix = normalizePrefix(config.customUrlPrefix || '')
-  const modelPrefix = config.addModelPrefix !== false ? '/${modelNameLower}' : ''
+  const modelPrefix = config.addModelPrefix !== false ? '/${modelSegment}' : ''
   const basePath = customPrefix + modelPrefix
 
   const openApiDisabled = config.disableOpenApi === true
     || (config.disableOpenApi !== false && (_env.DISABLE_OPENAPI === 'true' || _env.NODE_ENV === 'production'))
 
-  const postReadsEnabled = !config.disablePostReads
 
   let _openApiJsonCache: unknown = undefined
   const getOpenApiJson = (): unknown => {
@@ -394,7 +444,7 @@ export function ${routerFunctionName}<TCtx = unknown, TPrisma = any>(config: ${m
         MODEL_FIELDS as unknown as Parameters<typeof buildModelOpenApi>[1],
         MODEL_ENUMS as unknown as Parameters<typeof buildModelOpenApi>[2],
         config as unknown as Parameters<typeof buildModelOpenApi>[3],
-        { format: 'json', writeStrategy: '${writeStrategy}' },
+        { format: 'json', writeStrategy: '${writeStrategy}', pathSegment: '${modelSegment}' },
       )
     }
     return _openApiJsonCache
@@ -407,7 +457,7 @@ export function ${routerFunctionName}<TCtx = unknown, TPrisma = any>(config: ${m
         MODEL_FIELDS as unknown as Parameters<typeof buildModelOpenApi>[1],
         MODEL_ENUMS as unknown as Parameters<typeof buildModelOpenApi>[2],
         config as unknown as Parameters<typeof buildModelOpenApi>[3],
-        { format: 'yaml', writeStrategy: '${writeStrategy}' },
+        { format: 'yaml', writeStrategy: '${writeStrategy}', pathSegment: '${modelSegment}' },
       ) as string
     }
     return _openApiYamlCache
@@ -429,6 +479,8 @@ export function ${routerFunctionName}<TCtx = unknown, TPrisma = any>(config: ${m
     const extReq = req as ExtendedRequest
     const locals = readLocals(res)
     return {
+      operationOverride: locals.operationOverride,
+      resolveOperationContext: locals.getContext,
       prisma: extReq.prisma,
       postgres: extReq.postgres,
       sqlite: extReq.sqlite,
@@ -436,16 +488,12 @@ export function ${routerFunctionName}<TCtx = unknown, TPrisma = any>(config: ${m
       body: req.body,
       guardShape: locals.guardShape,
       guardCaller: locals.guardCaller,
+      guardVariantKey: locals.guardVariantKey,
       paginationConfig: locals.routeConfig?.pagination,
       findManyPaginatedMode: FIND_MANY_PAGINATED_MODE,
     }
   }
 
-  const buildResolveContext = (req: Request): (() => unknown | Promise<unknown>) | undefined => {
-    if (typeof config.resolveContext !== 'function') return undefined
-    return () => (config.resolveContext as (r: Request) => unknown | Promise<unknown>)(req)
-  }
-
   const parseQuery: RequestHandler = (req, res, next) => {
     const rawQuery = req.query
     if (rawQuery && Object.keys(rawQuery).length > 0) {
@@ -463,10 +511,24 @@ export function ${routerFunctionName}<TCtx = unknown, TPrisma = any>(config: ${m
     next()
   }
 
+  /**
+   * The environment bypass, and it is OPT-IN for this target.
+   *
+   * \`PGE_DROP_GUARD=true\` (deprecated alias \`E2E=true\`) downgrading enforcement
+   * in a deployed environment is a real hazard: on most platforms it is an
+   * ordinary config var, set on staging, copied forward, flagged as
+   * security-relevant nowhere. It is honoured only when this configuration
+   * states \`allowE2EGuardBypass: true\` — false or omitted means the environment
+   * cannot drop guards. The generation-time \`DROP_GUARD\` literal is unchanged.
+   */
+  const dropGuard = DROP_GUARD || (config.allowE2EGuardBypass === true && resolveDropGuardEnv(_env))
+
   const setShape = (opConfig: NormalizedOp, opKind: OpKind): RequestHandler => {
     return async (req, res, next) => {
+      const locals = readLocals(res)
       try {
-        const locals = readLocals(res)
+        locals.operationOverride = opConfig.override
+        locals.getContext = memoizeContext(() => config.resolveContext?.(req))
         const merged = mergePaginationConfig(config.pagination, opConfig.pagination)
         if (merged) {
           locals.routeConfig = { pagination: merged }
@@ -477,51 +539,69 @@ export function ${routerFunctionName}<TCtx = unknown, TPrisma = any>(config: ${m
         const caller = config.guard?.resolveVariant?.(req) ?? headerValue ?? undefined
         if (typeof caller === 'string') locals.guardCaller = caller
 
-        const resolution = resolveOperationVariantKey(opConfig.guardRouting, caller)
-        if (!resolution.ok) {
-          locals.guardVariantFailure = resolution
+        const routed = routeOperation({ guardRouting: opConfig.guardRouting, caller })
+        if (!routed.ok) {
+          locals.routeFailure = routed
           next()
           return
         }
 
-        const resolvedKey =
-          opConfig.guardRouting.kind === 'named'
-            ? resolution.key
-            : undefined
-        if (resolvedKey !== undefined) locals.guardVariantKey = resolvedKey
-
-        if (opConfig.guardShape) {
-          if (!DROP_GUARD) {
-            locals.guardShape = opConfig.guardShape
-          } else {
-            await applyDroppedGuard(
-              opConfig.guardShape,
-              resolvedKey,
-              buildResolveContext(req),
-              opKind,
-              {
-                readQuery: locals.parsedQuery,
-                writeBody: isPlainObject(req.body)
-                  ? (req.body as Record<string, unknown>)
-                  : undefined,
-              },
-              () => {
-                if (!locals.parsedQuery) locals.parsedQuery = {}
-                return locals.parsedQuery
-              },
-              () => {
-                if (!isPlainObject(req.body)) {
-                  req.body = {}
-                }
-                return req.body as Record<string, unknown>
-              },
-            )
-          }
+        if (routed.variantKey !== undefined) locals.guardVariantKey = routed.variantKey
+
+        const guard = await prepareGuardOperation(routed, {
+          guardShape: opConfig.guardShape,
+          opKind,
+          policy: { dropGuard, validateResolvedShapes: false },
+          getContext: typeof config.resolveContext === 'function' ? locals.getContext : undefined,
+          args: queryChannel(res),
+          writeArgs: bodyChannel(req),
+        })
+        if (!guard.ok) {
+          locals.guardFailure = guard
+          next()
+          return
         }
 
+        locals.guardShape = guard.guardShape
+
         next()
       } catch (err) {
-        next(mapError(err))
+        next(classifyError(err))
+      }
+    }
+  }
+
+  const maybeNdjsonFindMany = (
+    coreFn: (ctx: OperationContext) => Promise<unknown>,
+  ): RequestHandler => {
+    return async (req, res, next) => {
+      if (res.headersSent || res.writableEnded) return next()
+      if (req.method !== 'GET') return next()
+      if (!acceptsNdjson(req.headers.accept)) return next()
+
+      const locals = readLocals(res)
+      const rawArgs = (locals.parsedQuery ?? {}) as Record<string, unknown>
+      const args = { ...rawArgs }
+      const paginationCfg = mergePaginationConfig(config.pagination, undefined)
+      const requestedTake = typeof rawArgs.take === 'number' ? rawArgs.take : undefined
+      const initialSkip = typeof rawArgs.skip === 'number' ? rawArgs.skip : 0
+
+      try {
+        await runNdjsonFindMany({
+          res,
+          isClosed: () => req.destroyed,
+          fetchPage: (skip, pageTake) =>
+            coreFn({
+              ...buildContext(req, res),
+              parsedQuery: { ...args, skip, take: pageTake },
+            }),
+          initialSkip,
+          requestedTake,
+          defaultLimit: paginationCfg?.defaultLimit,
+          maxLimit: paginationCfg?.maxLimit ?? 1000,
+        })
+      } catch (err) {
+        next(err)
       }
     }
   }
@@ -552,6 +632,23 @@ export function ${routerFunctionName}<TCtx = unknown, TPrisma = any>(config: ${m
         }
 
         if (progressiveConfig.mode === 'autoInclude') {
+        if (progressiveConfig.experimental !== true) {
+          if (_env.NODE_ENV !== 'production') {
+            console.warn(
+              '[prisma-generator-express] auto-include progressive is experimental; set \`experimental: true\` on the progressive config to enable it. Falling back.'
+            )
+          }
+          if (progressiveConfig.fallback === 'error') {
+            emitTerminalSSEError(res, 'auto-include requires experimental: true')
+            return
+          }
+          await runSingleResultSSE({
+            req,
+            res,
+            coreQueryFn: () => coreFn(buildContext(req, res)),
+          })
+          return
+        }
           const isAutoIncludeReadable =
             baseOp === 'findUnique' || baseOp === 'findUniqueOrThrow' ||
             baseOp === 'findFirst' || baseOp === 'findFirstOrThrow' ||
@@ -619,11 +716,16 @@ export function ${routerFunctionName}<TCtx = unknown, TPrisma = any>(config: ${m
         }
 
         const ctx = await config.resolveContext(req)
+        const prismaClient = (req as ExtendedRequest).prisma
+        if (!prismaClient) {
+          emitTerminalSSEError(res, 'Progressive endpoint requires req.prisma to be set')
+          return
+        }
         await runProgressiveEndpoint({
           req,
           res,
           ctx,
-          prisma: (req as ExtendedRequest).prisma,
+          prisma: prismaClient,
           variant: variant as string,
           stages: progressiveConfig.stages,
           stageRegistry,
@@ -679,6 +781,7 @@ ${writeOpBlocks}
     const path = basePath ? \`\${basePath}/each\` : '/each'
     router.post(
       path,
+      ...(opConfig.authorize ? [opConfig.authorize] : []),
       setShape(opConfig, 'noop'),
       ...opConfig.operationBefore,
       async (req: Request, res: Response, next: NextFunction) => {
@@ -707,4 +810,4 @@ ${writeOpBlocks}
   return router
 }
 `
-}
+}