prisma-guard 1.21.0 → 1.22.0

package/dist/runtime/index.cjs

@@ -25,6 +25,7 @@ __export(runtime_exports, {
   ShapeError: () => ShapeError,
   createGuard: () => createGuard,
   force: () => force,
+  namedShapes: () => namedShapes,
   unsupported: () => unsupported
 });
 module.exports = __toCommonJS(runtime_exports);
@@ -222,7 +223,13 @@ function createScalarBase(strictDecimal) {
       import_zod.z.string().regex(/^-?\d+$/).transform((v) => BigInt(v))
     ]),
     Boolean: () => import_zod.z.boolean(),
-    DateTime: () => import_zod.z.union([import_zod.z.date(), import_zod.z.string().datetime({ offset: true })]).pipe(import_zod.z.coerce.date()),
+    DateTime: () => import_zod.z.union([
+      import_zod.z.date(),
+      import_zod.z.string().refine(
+        (s) => !isNaN(Date.parse(s)),
+        "Invalid date string"
+      )
+    ]).pipe(import_zod.z.coerce.date()),
     Json: () => import_zod.z.unknown().refine(
       isJsonSafe,
       "Value must be JSON-serializable (no undefined, functions, symbols, class instances, NaN, Infinity, or circular references)"
@@ -239,8 +246,8 @@ function wrapWithInputCoercion(fieldType, isList, schema) {
       break;
     case "Int":
       itemCoercion = import_zod.z.union([
-        import_zod.z.number().int(),
-        import_zod.z.string().regex(/^-?\d+$/).transform(Number)
+        import_zod.z.number().transform((v) => Math.trunc(v)).pipe(import_zod.z.number().int()),
+        import_zod.z.string().regex(/^-?\d+(\.\d+)?$/).transform((v) => Math.trunc(Number(v)))
       ]);
       break;
     case "Float":
@@ -818,7 +825,7 @@ function createSchemaBuilder(typeMap, zodChains, enumMap, scalarBase, zodDefault
 var import_zod7 = require("zod");
 
 // src/shared/constants.ts
-var SHAPE_CONFIG_KEYS = /* @__PURE__ */ new Set([
+var SHAPE_CONFIG_KEY_LIST = [
   "where",
   "include",
   "select",
@@ -834,13 +841,15 @@ var SHAPE_CONFIG_KEYS = /* @__PURE__ */ new Set([
   "_min",
   "_max",
   "by"
-]);
-var GUARD_SHAPE_KEYS = /* @__PURE__ */ new Set([
+];
+var SHAPE_CONFIG_KEYS = new Set(SHAPE_CONFIG_KEY_LIST);
+var GUARD_SHAPE_KEY_LIST = [
   "data",
   "create",
   "update",
-  ...SHAPE_CONFIG_KEYS
-]);
+  ...SHAPE_CONFIG_KEY_LIST
+];
+var GUARD_SHAPE_KEYS = new Set(GUARD_SHAPE_KEY_LIST);
 var COMBINATOR_KEYS = /* @__PURE__ */ new Set(["AND", "OR", "NOT"]);
 var TO_MANY_RELATION_OPS = /* @__PURE__ */ new Set(["some", "every", "none"]);
 var TO_ONE_RELATION_OPS = /* @__PURE__ */ new Set(["is", "isNot"]);
@@ -2478,67 +2487,51 @@ function createProjectionBuilder(typeMap, enumMap, deps) {
   return { buildIncludeSchema, buildSelectSchema, buildIncludeCountSchema };
 }
 
-// src/runtime/query-builder.ts
-var METHOD_ALLOWED_ARGS = {
-  findMany: /* @__PURE__ */ new Set([
-    "where",
-    "include",
-    "select",
-    "orderBy",
-    "cursor",
-    "take",
-    "skip",
-    "distinct"
-  ]),
-  findFirst: /* @__PURE__ */ new Set([
-    "where",
-    "include",
-    "select",
-    "orderBy",
-    "cursor",
-    "take",
-    "skip",
-    "distinct"
-  ]),
-  findFirstOrThrow: /* @__PURE__ */ new Set([
-    "where",
-    "include",
-    "select",
-    "orderBy",
-    "cursor",
-    "take",
-    "skip",
-    "distinct"
-  ]),
-  findUnique: /* @__PURE__ */ new Set(["where", "include", "select"]),
-  findUniqueOrThrow: /* @__PURE__ */ new Set(["where", "include", "select"]),
-  count: /* @__PURE__ */ new Set(["where", "select", "cursor", "orderBy", "skip", "take"]),
-  aggregate: /* @__PURE__ */ new Set([
-    "where",
-    "orderBy",
-    "cursor",
-    "take",
-    "skip",
-    "_count",
-    "_avg",
-    "_sum",
-    "_min",
-    "_max"
-  ]),
-  groupBy: /* @__PURE__ */ new Set([
-    "where",
-    "by",
-    "having",
-    "_count",
-    "_avg",
-    "_sum",
-    "_min",
-    "_max",
-    "orderBy",
-    "take",
-    "skip"
-  ])
+// src/shared/operation-shape-keys.ts
+var OPERATION_SHAPE_KEYS = {
+  findMany: ["where", "include", "select", "orderBy", "cursor", "take", "skip", "distinct"],
+  findFirst: ["where", "include", "select", "orderBy", "cursor", "take", "skip", "distinct"],
+  findFirstOrThrow: ["where", "include", "select", "orderBy", "cursor", "take", "skip", "distinct"],
+  findUnique: ["where", "include", "select"],
+  findUniqueOrThrow: ["where", "include", "select"],
+  findManyPaginated: ["where", "include", "select", "orderBy", "cursor", "take", "skip", "distinct"],
+  count: ["where", "select", "cursor", "orderBy", "skip", "take"],
+  aggregate: ["where", "orderBy", "cursor", "take", "skip", "_count", "_avg", "_sum", "_min", "_max"],
+  groupBy: ["where", "by", "having", "_count", "_avg", "_sum", "_min", "_max", "orderBy", "take", "skip"],
+  create: ["data", "select", "include"],
+  createMany: ["data"],
+  createManyAndReturn: ["data", "select", "include"],
+  update: ["data", "where", "select", "include"],
+  updateMany: ["data", "where"],
+  updateManyAndReturn: ["data", "where", "select", "include"],
+  upsert: ["where", "create", "update", "select", "include"],
+  delete: ["where", "select", "include"],
+  deleteMany: ["where"]
 };
+var READ_METHOD_ALLOWED_ARGS = {
+  findMany: new Set(OPERATION_SHAPE_KEYS.findMany),
+  findFirst: new Set(OPERATION_SHAPE_KEYS.findFirst),
+  findFirstOrThrow: new Set(OPERATION_SHAPE_KEYS.findFirstOrThrow),
+  findUnique: new Set(OPERATION_SHAPE_KEYS.findUnique),
+  findUniqueOrThrow: new Set(OPERATION_SHAPE_KEYS.findUniqueOrThrow),
+  count: new Set(OPERATION_SHAPE_KEYS.count),
+  aggregate: new Set(OPERATION_SHAPE_KEYS.aggregate),
+  groupBy: new Set(OPERATION_SHAPE_KEYS.groupBy)
+};
+var MUTATION_SHAPE_KEYS = {
+  create: new Set(OPERATION_SHAPE_KEYS.create),
+  createMany: new Set(OPERATION_SHAPE_KEYS.createMany),
+  createManyAndReturn: new Set(OPERATION_SHAPE_KEYS.createManyAndReturn),
+  update: new Set(OPERATION_SHAPE_KEYS.update),
+  updateMany: new Set(OPERATION_SHAPE_KEYS.updateMany),
+  updateManyAndReturn: new Set(OPERATION_SHAPE_KEYS.updateManyAndReturn),
+  upsert: new Set(OPERATION_SHAPE_KEYS.upsert),
+  delete: new Set(OPERATION_SHAPE_KEYS.delete),
+  deleteMany: new Set(OPERATION_SHAPE_KEYS.deleteMany)
+};
+
+// src/runtime/query-builder.ts
+var METHOD_ALLOWED_ARGS = READ_METHOD_ALLOWED_ARGS;
 var UNIQUE_WHERE_METHODS = /* @__PURE__ */ new Set([
   "findUnique",
   "findUniqueOrThrow"
@@ -2949,11 +2942,29 @@ function buildAndConditions(existingWhere, conditions) {
     return conditions[0];
   return { AND: conditions };
 }
-function buildScopedUniqueWhere(existingWhere, conditions) {
-  if (!existingWhere) {
+function stripScopeFksFromWhere(where, scopeFks, log, model) {
+  let result = where;
+  for (const fk of scopeFks) {
+    if (fk in result) {
+      if (result === where)
+        result = { ...where };
+      log.warn(
+        `prisma-guard: Scope FK "${fk}" found in where for model "${model}". Stripped in favor of scope context.`
+      );
+      delete result[fk];
+    }
+  }
+  return result;
+}
+function buildScopedUniqueWhere(existingWhere, conditions, scopeFks, log, model) {
+  let cleaned = existingWhere;
+  if (cleaned) {
+    cleaned = stripScopeFksFromWhere(cleaned, scopeFks, log, model);
+  }
+  if (!cleaned || Object.keys(cleaned).length === 0) {
     return conditions.length === 1 ? conditions[0] : { AND: conditions };
   }
-  const { AND: existingAnd, ...topLevel } = existingWhere;
+  const { AND: existingAnd, ...topLevel } = cleaned;
   const allConditions = [];
   if (existingAnd !== void 0) {
     if (Array.isArray(existingAnd)) {
@@ -3053,6 +3064,13 @@ function createScopeExtension(scopeMap, contextFn, guardConfig, logger) {
       `prisma-guard: Invalid onScopeRelationWrite "${onScopeRelationWrite}". Allowed: ${[...VALID_ON_SCOPE_RELATION_WRITES].join(", ")}`
     );
   }
+  const scopeFkSets = /* @__PURE__ */ new Map();
+  for (const [model, entries] of Object.entries(scopeMap)) {
+    const fks = /* @__PURE__ */ new Set();
+    for (const entry of entries)
+      fks.add(entry.fk);
+    scopeFkSets.set(model, fks);
+  }
   return {
     name: "prisma-guard-scope",
     query: {
@@ -3073,7 +3091,7 @@ function createScopeExtension(scopeMap, contextFn, guardConfig, logger) {
         if (missingRoots.length > 0) {
           if (isMutation || guardConfig.onMissingScopeContext === "error") {
             throw new PolicyError(
-              `Missing scope context for model "${model}": roots ${missingRoots.map((r) => `"${r}"`).join(", ")} not provided. All scope roots must be present.`
+              `prisma-guard: Missing scope context for model "${model}": roots ${missingRoots.map((r) => `"${r}"`).join(", ")} not provided. All scope roots must be present.`
             );
           }
           if (guardConfig.onMissingScopeContext === "warn") {
@@ -3089,9 +3107,10 @@ function createScopeExtension(scopeMap, contextFn, guardConfig, logger) {
         const overrides = Object.fromEntries(
           presentScopes.map((s) => [s.fk, ctx[s.root]])
         );
+        const modelFks = scopeFkSets.get(model) ?? /* @__PURE__ */ new Set();
         const nextArgs = { ...args };
         if (operation === "upsert") {
-          nextArgs.where = buildScopedUniqueWhere(args.where, conditions);
+          nextArgs.where = buildScopedUniqueWhere(args.where, conditions, modelFks, log, model);
           if (args.create !== void 0 && args.create !== null) {
             if (typeof args.create !== "object" || Array.isArray(args.create)) {
               throw new ShapeError(`upsert expects create to be an object`);
@@ -3129,7 +3148,7 @@ function createScopeExtension(scopeMap, contextFn, guardConfig, logger) {
         if (FIND_UNIQUE_OPS.has(operation)) {
           if (findUniqueMode === "reject") {
             throw new PolicyError(
-              `Scoped model "${model}" does not allow ${operation} via scope extension (findUniqueMode is "reject"). Use findFirst with explicit where conditions instead.`
+              `prisma-guard: Scoped model "${model}" does not allow ${operation} via scope extension (findUniqueMode is "reject"). Use findFirst with explicit where conditions instead.`
             );
           }
           return handleFindUnique(
@@ -3199,7 +3218,7 @@ function createScopeExtension(scopeMap, contextFn, guardConfig, logger) {
           return query(nextArgs);
         }
         if (UNIQUE_MUTATION_OPS.has(operation)) {
-          nextArgs.where = buildScopedUniqueWhere(args.where, conditions);
+          nextArgs.where = buildScopedUniqueWhere(args.where, conditions, modelFks, log, model);
           if (args.data !== void 0 && args.data !== null) {
             if (typeof args.data !== "object" || Array.isArray(args.data)) {
               throw new ShapeError(`${operation} expects data to be an object`);
@@ -3239,7 +3258,7 @@ function createScopeExtension(scopeMap, contextFn, guardConfig, logger) {
           return query(nextArgs);
         }
         throw new ShapeError(
-          `Unknown operation "${operation}" on scoped model "${model}". Update prisma-guard to handle this operation.`
+          `prisma-guard: Unknown operation "${operation}" on scoped model "${model}". Update prisma-guard to handle this operation.`
         );
       }
     }
@@ -3310,7 +3329,7 @@ async function handleFindUnique(args, query, conditions, scopes, operation, log,
     if (!looseEqual(verifyObj[fk], value, log, fk)) {
       if (operation === "findUniqueOrThrow") {
         throw new PolicyError(
-          `Record on model "${model}" not accessible in current scope`
+          `prisma-guard: Record on model "${model}" not accessible in current scope`
         );
       }
       return null;
@@ -4382,8 +4401,10 @@ function createModelGuardExtension(config) {
         equalityFields.add(key);
         continue;
       }
-      if (isPlainObject(value) && "equals" in value) {
-        equalityFields.add(key);
+      if (isPlainObject(value)) {
+        if ("equals" in value) {
+          equalityFields.add(key);
+        }
         continue;
       }
       if (value !== null && value !== void 0) {
@@ -5258,6 +5279,11 @@ function createGuard(config) {
     }
   };
 }
+
+// src/shared/typed-shape.ts
+function namedShapes(shapes) {
+  return shapes;
+}
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
   CallerError,
@@ -5265,6 +5291,7 @@ function createGuard(config) {
   ShapeError,
   createGuard,
   force,
+  namedShapes,
   unsupported
 });
 //# sourceMappingURL=index.cjs.map