prisma-guard 1.29.0 → 1.30.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/runtime/index.cjs +36 -23
- package/dist/runtime/index.cjs.map +1 -1
- package/dist/runtime/index.js +36 -23
- package/dist/runtime/index.js.map +1 -1
- package/package.json +1 -1
package/dist/runtime/index.js
CHANGED
|
@@ -276,6 +276,9 @@ function isPlainObject(v) {
|
|
|
276
276
|
const proto = Object.getPrototypeOf(v);
|
|
277
277
|
return proto === Object.prototype || proto === null;
|
|
278
278
|
}
|
|
279
|
+
function isObjectLike(v) {
|
|
280
|
+
return typeof v === "object" && v !== null && !Array.isArray(v);
|
|
281
|
+
}
|
|
279
282
|
function schemaProducesValueForUndefined(schema) {
|
|
280
283
|
const result = schema.safeParse(void 0);
|
|
281
284
|
return result.success && result.data !== void 0;
|
|
@@ -4849,12 +4852,23 @@ function walkForClientContent(obj, predicate, depth) {
|
|
|
4849
4852
|
const nested = value;
|
|
4850
4853
|
if (nested.orderBy || nested.cursor || nested.take || nested.skip)
|
|
4851
4854
|
return true;
|
|
4852
|
-
if (nested.where && isPlainObject(nested.where) && hasClientControlledValues(
|
|
4855
|
+
if (nested.where && isPlainObject(nested.where) && hasClientControlledValues(
|
|
4856
|
+
nested.where,
|
|
4857
|
+
depth + 1
|
|
4858
|
+
)) {
|
|
4853
4859
|
return true;
|
|
4854
4860
|
}
|
|
4855
|
-
if (nested.include && walkForClientContent(
|
|
4861
|
+
if (nested.include && walkForClientContent(
|
|
4862
|
+
nested.include,
|
|
4863
|
+
predicate,
|
|
4864
|
+
depth + 1
|
|
4865
|
+
))
|
|
4856
4866
|
return true;
|
|
4857
|
-
if (nested.select && walkForClientContent(
|
|
4867
|
+
if (nested.select && walkForClientContent(
|
|
4868
|
+
nested.select,
|
|
4869
|
+
predicate,
|
|
4870
|
+
depth + 1
|
|
4871
|
+
))
|
|
4858
4872
|
return true;
|
|
4859
4873
|
}
|
|
4860
4874
|
return false;
|
|
@@ -4876,11 +4890,19 @@ function hasClientControlledValues(obj, depth = 0) {
|
|
|
4876
4890
|
function hasNestedClientControlledArgs(shape) {
|
|
4877
4891
|
const predicate = () => false;
|
|
4878
4892
|
if (shape.include) {
|
|
4879
|
-
if (walkForClientContent(
|
|
4893
|
+
if (walkForClientContent(
|
|
4894
|
+
shape.include,
|
|
4895
|
+
predicate,
|
|
4896
|
+
0
|
|
4897
|
+
))
|
|
4880
4898
|
return true;
|
|
4881
4899
|
}
|
|
4882
4900
|
if (shape.select) {
|
|
4883
|
-
if (walkForClientContent(
|
|
4901
|
+
if (walkForClientContent(
|
|
4902
|
+
shape.select,
|
|
4903
|
+
predicate,
|
|
4904
|
+
0
|
|
4905
|
+
))
|
|
4884
4906
|
return true;
|
|
4885
4907
|
}
|
|
4886
4908
|
return false;
|
|
@@ -5178,15 +5200,13 @@ function createModelGuardExtension(config) {
|
|
|
5178
5200
|
let result = {};
|
|
5179
5201
|
if (built.schema) {
|
|
5180
5202
|
if (bodyWhere !== void 0 && bodyWhere !== null) {
|
|
5181
|
-
if (!
|
|
5203
|
+
if (!isObjectLike(bodyWhere)) {
|
|
5182
5204
|
throw new ShapeError(
|
|
5183
|
-
`Invalid "where" on model "${modelName}": unique where must be
|
|
5205
|
+
`Invalid "where" on model "${modelName}": unique where must be an object`
|
|
5184
5206
|
);
|
|
5185
5207
|
}
|
|
5186
|
-
const
|
|
5187
|
-
|
|
5188
|
-
built.forced
|
|
5189
|
-
) : { ...bodyWhere };
|
|
5208
|
+
const bodyWhereObj = { ...bodyWhere };
|
|
5209
|
+
const sanitized = hasWhereForced(built.forced) ? stripUniqueWhereForcedInput(bodyWhereObj, built.forced) : bodyWhereObj;
|
|
5190
5210
|
try {
|
|
5191
5211
|
result = built.schema.parse(sanitized);
|
|
5192
5212
|
} catch (err) {
|
|
@@ -5198,11 +5218,9 @@ function createModelGuardExtension(config) {
|
|
|
5198
5218
|
}
|
|
5199
5219
|
}
|
|
5200
5220
|
} else if (bodyWhere !== void 0 && bodyWhere !== null) {
|
|
5201
|
-
if (
|
|
5202
|
-
const
|
|
5203
|
-
|
|
5204
|
-
built.forced
|
|
5205
|
-
) : { ...bodyWhere };
|
|
5221
|
+
if (isObjectLike(bodyWhere)) {
|
|
5222
|
+
const bodyWhereObj = { ...bodyWhere };
|
|
5223
|
+
const sanitized = hasWhereForced(built.forced) ? stripUniqueWhereForcedInput(bodyWhereObj, built.forced) : bodyWhereObj;
|
|
5206
5224
|
if (Object.keys(sanitized).length > 0) {
|
|
5207
5225
|
throw new ShapeError(
|
|
5208
5226
|
`Unique where on model "${modelName}" contains only forced values. Client where input is not accepted.`
|
|
@@ -5210,7 +5228,7 @@ function createModelGuardExtension(config) {
|
|
|
5210
5228
|
}
|
|
5211
5229
|
} else {
|
|
5212
5230
|
throw new ShapeError(
|
|
5213
|
-
`Invalid "where" on model "${modelName}": unique where must be
|
|
5231
|
+
`Invalid "where" on model "${modelName}": unique where must be an object`
|
|
5214
5232
|
);
|
|
5215
5233
|
}
|
|
5216
5234
|
}
|
|
@@ -5563,12 +5581,7 @@ function createModelGuardExtension(config) {
|
|
|
5563
5581
|
"upsert",
|
|
5564
5582
|
"shape"
|
|
5565
5583
|
);
|
|
5566
|
-
validateAllowedKeys(
|
|
5567
|
-
resolved.body,
|
|
5568
|
-
allowedBodyKeys,
|
|
5569
|
-
"upsert",
|
|
5570
|
-
"body"
|
|
5571
|
-
);
|
|
5584
|
+
validateAllowedKeys(resolved.body, allowedBodyKeys, "upsert", "body");
|
|
5572
5585
|
validateUniqueWhereShapeConfig(
|
|
5573
5586
|
modelName,
|
|
5574
5587
|
resolved.shape.where,
|