prisma-generator-express 1.66.0 → 1.68.0

package/src/generators/generateRouterFastify.ts

@@ -1,8 +1,9 @@
-import { DMMF } from '@prisma/generator-helper'
+import type { DMMF } from '@prisma/generator-helper'
 import { generateRouteConfigType } from './generateRouteConfigType'
-import { ImportStyle } from '../utils/resolveImportStyle'
+import type { ImportStyle } from '../utils/resolveImportStyle'
 import { importExt } from '../utils/importExt'
-import { WriteStrategy, FindManyPaginatedMode } from '../constants'
+import type { WriteStrategy, FindManyPaginatedMode } from '../constants'
+import { modelPathSegment, type PathCase } from '../utils/pathCasing'
 import { OPERATION_METADATA } from '../copy/operationDefinitions'
 
 function pathExpr(suffix: string): string {
@@ -55,11 +56,11 @@ function emitReadOp(
 
   const postReadLine = meta.supportsPostRead
     ? meta.name === 'findMany'
-      ? `      if (postReadsEnabled) {
+      ? `      if (resolvePostReadsEnabled(config.disablePostReads, opConfig.disablePostReads)) {
         const postPath = basePath ? \`\${basePath}/read\` : '/read'
         instance.post(postPath, handleRead(opConfig, ${handlerName}, parseBodyAsQueryHook, '${opKind}'))
       }`
-      : `      if (postReadsEnabled) instance.post(path, handleRead(opConfig, ${handlerName}, parseBodyAsQueryHook, '${opKind}'))`
+      : `      if (resolvePostReadsEnabled(config.disablePostReads, opConfig.disablePostReads)) instance.post(path, handleRead(opConfig, ${handlerName}, parseBodyAsQueryHook, '${opKind}'))`
     : ''
 
   return `    if (isEnabled(config.${meta.configKey})) {
@@ -90,34 +91,41 @@ export function generateFastifyRouterFunction({
   model,
   enums,
   guardShapesImport,
+  clientImport,
   importStyle,
   writeStrategy,
   findManyPaginatedMode,
   dropGuard,
+  pathCase,
 }: {
   model: DMMF.Model
   enums: DMMF.DatamodelEnum[]
   guardShapesImport: string | null
+  clientImport?: string
   importStyle: ImportStyle
   writeStrategy: WriteStrategy
   findManyPaginatedMode: FindManyPaginatedMode
   dropGuard: boolean
+  pathCase: PathCase
 }): string {
   const ext = importExt(importStyle)
   const modelName = model.name
-  const modelNameLower = modelName.toLowerCase()
-  const routerFunctionName = `${modelName}Router`
+  const modelSegment = modelPathSegment(model.name, pathCase)
+  const routerFunctionName = `${model.name}Router`
 
-  const handlerImports = OPERATION_METADATA
-    .map((m) => `  ${modelName}${m.name.charAt(0).toUpperCase() + m.name.slice(1)},`)
-    .join('\n')
+  const handlerImports = OPERATION_METADATA.map(
+    (m) => `  ${modelName}${m.name.charAt(0).toUpperCase() + m.name.slice(1)},`,
+  ).join('\n')
 
   const readOps = OPERATION_METADATA.filter((m) => m.kind === 'read')
-  const writeOps = OPERATION_METADATA.filter((m) => m.kind === 'write' || m.kind === 'batch')
-    .filter((m) => m.name !== 'updateEach')
+  const writeOps = OPERATION_METADATA.filter(
+    (m) => m.kind === 'write' || m.kind === 'batch',
+  ).filter((m) => m.name !== 'updateEach')
 
   const readOpBlocks = readOps.map((m) => emitReadOp(m, modelName)).join('\n\n')
-  const writeOpBlocks = writeOps.map((m) => emitWriteOp(m, modelName)).join('\n\n')
+  const writeOpBlocks = writeOps
+    .map((m) => emitWriteOp(m, modelName))
+    .join('\n\n')
 
   return `import type { FastifyInstance, FastifyRequest, FastifyReply, FastifyError } from 'fastify'
 import { startQueryBuilder } from '../queryBuilder${ext}'
@@ -129,35 +137,49 @@ import type {
   FastifyHookHandler,
   FindManyPaginatedMode,
   PaginationConfig,
+  PrismaClientLike,
+  QueryBuilderConfig,
 } from '../routeConfig.target${ext}'
 import { parseQueryParams } from '../parseQueryParams${ext}'
-import { sanitizeKeys, normalizePrefix, getEnv, isPlainObject } from '../misc${ext}'
+import { sanitizeKeys, normalizePrefix, getEnv, isPlainObject, resolveDropGuardEnv } from '../misc${ext}'
 import { buildModelOpenApi } from '../buildModelOpenApi${ext}'
 import {
   normalizeOperation,
-  resolveOperationVariantKey,
   validateCountSourceWhere,
   validateOperationConfig,
   validateUpdateEachConfig,
+  resolvePostReadsEnabled,
+  warnIfUnguardedRoutes,
 } from '../routeConfig${ext}'
+import type { RuntimeOperationOverride } from '../operationRuntime${ext}'
 import type { NormalizedOperationConfig } from '../routeConfig${ext}'
 import type { OperationContext } from '../operationRuntime${ext}'
 import { transformResult } from '../operationRuntime${ext}'
 import { HttpError, mapError } from '../errorMapper${ext}'
-import { formatGuardVariantResolutionError } from '../guardVariantError${ext}'
-import type { GuardVariantResolution } from '../guardVariantRouting${ext}'
 import { mergePaginationConfig } from '../pagination${ext}'
-import { applyDroppedGuard } from '../projectionDefaults${ext}'
+import {
+  routeOperation,
+  prepareGuardOperation,
+  settleStage,
+  classifyError,
+  memoizeContext,
+  type ArgsChannel,
+} from '../operationPipeline${ext}'
 import type { OpKind } from '../projectionDefaults${ext}'
 import { MODEL_FIELDS, MODEL_ENUMS } from './${modelName}Metadata${ext}'
 
-${generateRouteConfigType(modelName, 'FastifyHookHandler', guardShapesImport, importStyle, 'fastify')}
+${generateRouteConfigType(modelName, 'FastifyHookHandler', guardShapesImport, importStyle, 'fastify', clientImport)}
 const _env = getEnv()
 
 const FIND_MANY_PAGINATED_MODE: FindManyPaginatedMode = '${findManyPaginatedMode}'
-const DROP_GUARD = ${dropGuard} || _env.E2E === 'true'
+// Fixed at generation time. The environment bypass is resolved per hook,
+// because it requires the configuration's explicit \`allowE2EGuardBypass: true\`:
+// false or omitted means the environment cannot drop guards for this target.
+const DROP_GUARD = ${dropGuard}
 
 type OperationConfigLike = {
+  authorize?: FastifyHookHandler
+  override?: RuntimeOperationOverride
   before?: FastifyHookHandler[]
   after?: FastifyHookHandler[]
   shape?: unknown
@@ -185,26 +207,51 @@ type FastifyExtended = FastifyRequest & {
   routeConfig?: { pagination?: PaginationConfig }
   guardShape?: Record<string, unknown>
   guardCaller?: string
+  operationOverride?: RuntimeOperationOverride
+  getContext?: () => Promise<unknown>
   guardVariantKey?: string
-  guardVariantFailure?: Extract<GuardVariantResolution, { ok: false }>
+  routeFailure?: { ok: false; failure: HttpError }
+  guardFailure?: { ok: false; failure: HttpError }
   resultData?: unknown
   resultStatus?: number
 }
 
+function queryChannel(request: FastifyRequest): ArgsChannel {
+  const fx = request as FastifyExtended
+  return {
+    read: () => fx.parsedQuery,
+    write: (next) => {
+      fx.parsedQuery = next
+    },
+  }
+}
+
+function bodyChannel(request: FastifyRequest): ArgsChannel {
+  return {
+    read: () =>
+      isPlainObject(request.body)
+        ? (request.body as Record<string, unknown>)
+        : undefined,
+    write: (next) => {
+      ;(request as unknown as { body: unknown }).body = next
+    },
+  }
+}
+
 function normalizeFastifyOperation(
   config: OperationConfigLike | undefined,
 ): NormalizedOp {
   return normalizeOperation<FastifyHookHandler, FastifyHookHandler>(config)
 }
 
-function isQueryBuilderEnabled(config: RouteConfig): boolean {
+function isQueryBuilderEnabled(config: { queryBuilder?: QueryBuilderConfig | false }): boolean {
   if (config.queryBuilder === false) return false
   if (typeof config.queryBuilder === 'object' && config.queryBuilder.enabled === false) return false
   if (_env.NODE_ENV === 'production') return false
   return true
 }
 
-function getQueryBuilderConfig(config: RouteConfig) {
+function getQueryBuilderConfig(config: { queryBuilder?: QueryBuilderConfig | false }) {
   if (config.queryBuilder === false) return null
   if (typeof config.queryBuilder === 'object') return config.queryBuilder
   return {}
@@ -225,21 +272,26 @@ function parseBodyAsQueryHook(request: FastifyRequest): void {
   (request as FastifyExtended).parsedQuery = sanitizeKeys(body as Record<string, unknown>)
 }
 
-function buildResolveContext(
-  config: ${modelName}RouteConfig,
-  request: FastifyRequest,
-): (() => unknown | Promise<unknown>) | undefined {
-  if (typeof config.resolveContext !== 'function') return undefined
-  return () => (config.resolveContext as (r: FastifyRequest) => unknown | Promise<unknown>)(request)
-}
-
-function makeShapeHook(
-  config: ${modelName}RouteConfig,
+function makeShapeHook<TCtx, TPrisma extends PrismaClientLike>(
+  config: ${modelName}RouteConfig<TCtx, TPrisma>,
   opConfig: NormalizedOp,
   opKind: OpKind,
 ): (request: FastifyRequest) => Promise<void> {
+  /**
+   * The environment bypass, and it is OPT-IN for this target.
+   *
+   * \`PGE_DROP_GUARD=true\` (deprecated alias \`E2E=true\`) downgrading enforcement
+   * in a deployed environment is a real hazard: on most platforms it is an
+   * ordinary config var, set on staging, copied forward, flagged as
+   * security-relevant nowhere. It is honoured only when this configuration
+   * states \`allowE2EGuardBypass: true\` — false or omitted means the environment
+   * cannot drop guards. The generation-time \`DROP_GUARD\` literal is unchanged.
+   */
+  const dropGuard = DROP_GUARD || (config.allowE2EGuardBypass === true && resolveDropGuardEnv(_env))
   return async (request: FastifyRequest) => {
     const fx = request as FastifyExtended
+    fx.operationOverride = opConfig.override
+    fx.getContext = memoizeContext(() => config.resolveContext?.(request))
     const merged = mergePaginationConfig(config.pagination, opConfig.pagination)
     if (merged) fx.routeConfig = { pagination: merged }
 
@@ -250,46 +302,28 @@ function makeShapeHook(
       ?? undefined
     if (typeof caller === 'string') fx.guardCaller = caller
 
-    const resolution = resolveOperationVariantKey(opConfig.guardRouting, caller)
-    if (!resolution.ok) {
-      fx.guardVariantFailure = resolution
+    const routed = routeOperation({ guardRouting: opConfig.guardRouting, caller })
+    if (!routed.ok) {
+      fx.routeFailure = routed
       return
     }
 
-    const resolvedKey =
-      opConfig.guardRouting.kind === 'named'
-        ? resolution.key
-        : undefined
-    if (resolvedKey !== undefined) fx.guardVariantKey = resolvedKey
-
-    if (opConfig.guardShape) {
-      if (!DROP_GUARD) {
-        fx.guardShape = opConfig.guardShape
-      } else {
-        await applyDroppedGuard(
-          opConfig.guardShape,
-          resolvedKey,
-          buildResolveContext(config, request),
-          opKind,
-          {
-            readQuery: fx.parsedQuery,
-            writeBody: isPlainObject(request.body)
-              ? (request.body as Record<string, unknown>)
-              : undefined,
-          },
-          () => {
-            if (!fx.parsedQuery) fx.parsedQuery = {}
-            return fx.parsedQuery
-          },
-          () => {
-            if (!isPlainObject(request.body)) {
-              ;(request as unknown as { body: unknown }).body = {}
-            }
-            return request.body as Record<string, unknown>
-          },
-        )
-      }
+    if (routed.variantKey !== undefined) fx.guardVariantKey = routed.variantKey
+
+    const guard = await prepareGuardOperation(routed, {
+      guardShape: opConfig.guardShape,
+      opKind,
+      policy: { dropGuard, validateResolvedShapes: false },
+      getContext: typeof config.resolveContext === 'function' ? fx.getContext : undefined,
+      args: queryChannel(request),
+      writeArgs: bodyChannel(request),
+    })
+    if (!guard.ok) {
+      fx.guardFailure = guard
+      return
     }
+
+    fx.guardShape = guard.guardShape
   }
 }
 
@@ -322,7 +356,7 @@ function sendError(reply: FastifyReply, error: unknown): void {
   reply.code(httpError.status).send({ message: httpError.message })
 }
 
-export async function ${routerFunctionName}<TCtx = unknown, TPrisma = any>(
+export async function ${routerFunctionName}<TCtx = unknown, TPrisma extends PrismaClientLike = PrismaClientLike>(
   fastify: FastifyInstance,
   config: ${modelName}RouteConfig<TCtx, TPrisma> = {},
 ) {
@@ -334,6 +368,7 @@ export async function ${routerFunctionName}<TCtx = unknown, TPrisma = any>(
 
   await fastify.register(async (instance) => {
     const isEnabled = (value: unknown): boolean => value !== false && !!(config.enableAll || value)
+  warnIfUnguardedRoutes('${modelName}', ['findMany', 'findUnique', 'findUniqueOrThrow', 'findFirst', 'findFirstOrThrow', 'findManyPaginated', 'count', 'aggregate', 'groupBy', 'create', 'createMany', 'createManyAndReturn', 'update', 'updateMany', 'updateManyAndReturn', 'upsert', 'delete', 'deleteMany'], config, isEnabled)
 
     const opFor = (key: string): NormalizedOp => {
       const raw = (config as unknown as Record<string, unknown>)[key] as OperationConfigLike | undefined
@@ -342,7 +377,7 @@ export async function ${routerFunctionName}<TCtx = unknown, TPrisma = any>(
     }
 
     const customPrefix = normalizePrefix(config.customUrlPrefix || '')
-    const modelPrefix = config.addModelPrefix !== false ? '/${modelNameLower}' : ''
+    const modelPrefix = config.addModelPrefix !== false ? '/${modelSegment}' : ''
     const basePath = customPrefix + modelPrefix
 
     const openApiDisabled = config.disableOpenApi === true
@@ -351,7 +386,6 @@ export async function ${routerFunctionName}<TCtx = unknown, TPrisma = any>(
         || _env.DISABLE_OPENAPI === 'true'
       ))
 
-    const postReadsEnabled = !config.disablePostReads
 
     let _openApiJsonCache: unknown = undefined
     const getOpenApiJson = (): unknown => {
@@ -360,8 +394,8 @@ export async function ${routerFunctionName}<TCtx = unknown, TPrisma = any>(
           '${modelName}',
           MODEL_FIELDS as unknown as Parameters<typeof buildModelOpenApi>[1],
           MODEL_ENUMS as unknown as Parameters<typeof buildModelOpenApi>[2],
-          config,
-          { format: 'json', writeStrategy: '${writeStrategy}' },
+          config as unknown as Parameters<typeof buildModelOpenApi>[3],
+          { format: 'json', writeStrategy: '${writeStrategy}', pathSegment: '${modelSegment}' },
         )
       }
       return _openApiJsonCache
@@ -373,8 +407,8 @@ export async function ${routerFunctionName}<TCtx = unknown, TPrisma = any>(
           '${modelName}',
           MODEL_FIELDS as unknown as Parameters<typeof buildModelOpenApi>[1],
           MODEL_ENUMS as unknown as Parameters<typeof buildModelOpenApi>[2],
-          config,
-          { format: 'yaml', writeStrategy: '${writeStrategy}' },
+          config as unknown as Parameters<typeof buildModelOpenApi>[3],
+          { format: 'yaml', writeStrategy: '${writeStrategy}', pathSegment: '${modelSegment}' },
         ) as string
       }
       return _openApiYamlCache
@@ -424,17 +458,14 @@ export async function ${routerFunctionName}<TCtx = unknown, TPrisma = any>(
       opKind: OpKind,
     ) => async (request: FastifyRequest, reply: FastifyReply) => {
       try {
+        if (await runHooks(opConfig.authorize ? [opConfig.authorize] : [], request, reply)) return
         parseFn(request)
         await makeShapeHook(config, opConfig, opKind)(request)
         if (await runHooks(opConfig.operationBefore, request, reply)) return
 
         const fx = request as FastifyExtended
-        if (fx.guardVariantFailure) {
-          throw new HttpError(
-            400,
-            formatGuardVariantResolutionError(fx.guardVariantFailure),
-          )
-        }
+        if (fx.routeFailure) settleStage(fx.routeFailure)
+        if (fx.guardFailure) settleStage(fx.guardFailure)
 
         const key = fx.guardVariantKey
         const variantHooks =
@@ -456,16 +487,13 @@ export async function ${routerFunctionName}<TCtx = unknown, TPrisma = any>(
       opKind: OpKind,
     ) => async (request: FastifyRequest, reply: FastifyReply) => {
       try {
+        if (await runHooks(opConfig.authorize ? [opConfig.authorize] : [], request, reply)) return
         await makeShapeHook(config, opConfig, opKind)(request)
         if (await runHooks(opConfig.operationBefore, request, reply)) return
 
         const fx = request as FastifyExtended
-        if (fx.guardVariantFailure) {
-          throw new HttpError(
-            400,
-            formatGuardVariantResolutionError(fx.guardVariantFailure),
-          )
-        }
+        if (fx.routeFailure) settleStage(fx.routeFailure)
+        if (fx.guardFailure) settleStage(fx.guardFailure)
 
         const key = fx.guardVariantKey
         const variantHooks =
@@ -514,4 +542,4 @@ ${writeOpBlocks}
   })
 }
 `
-}
+}