prisma-guard 1.29.0 → 1.31.0

package/dist/runtime/index.d.cts

@@ -13,6 +13,7 @@ interface FieldMeta {
     isEnum?: boolean;
     isUnique?: boolean;
     isUnsupported?: boolean;
+    relationFromFields?: readonly string[];
 }
 interface GuardLogger {
     warn(message: string): void;
@@ -228,6 +229,7 @@ interface FieldMetaConst {
     readonly isEnum?: boolean;
     readonly isUnique?: boolean;
     readonly isUnsupported?: boolean;
+    readonly relationFromFields?: readonly string[];
 }
 interface UniqueConstraintConst {
     readonly selector: string;

package/dist/runtime/index.d.ts

@@ -13,6 +13,7 @@ interface FieldMeta {
     isEnum?: boolean;
     isUnique?: boolean;
     isUnsupported?: boolean;
+    relationFromFields?: readonly string[];
 }
 interface GuardLogger {
     warn(message: string): void;
@@ -228,6 +229,7 @@ interface FieldMetaConst {
     readonly isEnum?: boolean;
     readonly isUnique?: boolean;
     readonly isUnsupported?: boolean;
+    readonly relationFromFields?: readonly string[];
 }
 interface UniqueConstraintConst {
     readonly selector: string;

package/dist/runtime/index.js

@@ -276,6 +276,9 @@ function isPlainObject(v) {
   const proto = Object.getPrototypeOf(v);
   return proto === Object.prototype || proto === null;
 }
+function isObjectLike(v) {
+  return typeof v === "object" && v !== null && !Array.isArray(v);
+}
 function schemaProducesValueForUndefined(schema) {
   const result = schema.safeParse(void 0);
   return result.success && result.data !== void 0;
@@ -4107,12 +4110,39 @@ function validateAllowedKeys(value, allowed, method, kind) {
     return `Shape key "${key}" not valid for ${method}. Allowed: ${[...allowed].join(", ")}`;
   });
 }
+var RELATION_OPS_COVERING_FK = /* @__PURE__ */ new Set([
+  "connect",
+  "connectOrCreate",
+  "create"
+]);
+function collectRelationCoveredFks(modelFields, dataConfig) {
+  const covered = /* @__PURE__ */ new Set();
+  for (const [fieldName, value] of Object.entries(dataConfig)) {
+    const meta = modelFields[fieldName];
+    if (!meta || !meta.isRelation)
+      continue;
+    const fks = meta.relationFromFields;
+    if (!fks || fks.length === 0)
+      continue;
+    if (!isPlainObject(value))
+      continue;
+    const covers = Object.keys(value).some(
+      (op) => RELATION_OPS_COVERING_FK.has(op)
+    );
+    if (!covers)
+      continue;
+    for (const fk of fks)
+      covered.add(fk);
+  }
+  return covered;
+}
 function validateCreateCompleteness(modelName, dataConfig, typeMap, scopeFks, zodDefaults) {
   const modelFields = typeMap[modelName];
   if (!modelFields)
     return;
   const zodDefaultFields = zodDefaults[modelName];
   const zodDefaultSet = zodDefaultFields ? new Set(zodDefaultFields) : void 0;
+  const relationCoveredFks = collectRelationCoveredFks(modelFields, dataConfig);
   for (const [fieldName, meta] of Object.entries(modelFields)) {
     if (meta.isRelation)
       continue;
@@ -4126,10 +4156,12 @@ function validateCreateCompleteness(modelName, dataConfig, typeMap, scopeFks, zo
       continue;
     if (scopeFks.has(fieldName))
       continue;
+    if (relationCoveredFks.has(fieldName))
+      continue;
     if (zodDefaultSet && zodDefaultSet.has(fieldName))
       continue;
     throw new ShapeError(
-      `Required field "${fieldName}" on model "${modelName}" is missing from create data shape, has no default, and is not a scope FK`
+      `Required field "${fieldName}" on model "${modelName}" is missing from create data shape, has no default, is not a scope FK, and is not covered by a relation write in the shape`
     );
   }
 }
@@ -4849,12 +4881,23 @@ function walkForClientContent(obj, predicate, depth) {
     const nested = value;
     if (nested.orderBy || nested.cursor || nested.take || nested.skip)
       return true;
-    if (nested.where && isPlainObject(nested.where) && hasClientControlledValues(nested.where, depth + 1)) {
+    if (nested.where && isPlainObject(nested.where) && hasClientControlledValues(
+      nested.where,
+      depth + 1
+    )) {
       return true;
     }
-    if (nested.include && walkForClientContent(nested.include, predicate, depth + 1))
+    if (nested.include && walkForClientContent(
+      nested.include,
+      predicate,
+      depth + 1
+    ))
       return true;
-    if (nested.select && walkForClientContent(nested.select, predicate, depth + 1))
+    if (nested.select && walkForClientContent(
+      nested.select,
+      predicate,
+      depth + 1
+    ))
       return true;
   }
   return false;
@@ -4876,11 +4919,19 @@ function hasClientControlledValues(obj, depth = 0) {
 function hasNestedClientControlledArgs(shape) {
   const predicate = () => false;
   if (shape.include) {
-    if (walkForClientContent(shape.include, predicate, 0))
+    if (walkForClientContent(
+      shape.include,
+      predicate,
+      0
+    ))
       return true;
   }
   if (shape.select) {
-    if (walkForClientContent(shape.select, predicate, 0))
+    if (walkForClientContent(
+      shape.select,
+      predicate,
+      0
+    ))
       return true;
   }
   return false;
@@ -5178,15 +5229,13 @@ function createModelGuardExtension(config) {
       let result = {};
       if (built.schema) {
         if (bodyWhere !== void 0 && bodyWhere !== null) {
-          if (!isPlainObject(bodyWhere)) {
+          if (!isObjectLike(bodyWhere)) {
             throw new ShapeError(
-              `Invalid "where" on model "${modelName}": unique where must be a plain object`
+              `Invalid "where" on model "${modelName}": unique where must be an object`
             );
           }
-          const sanitized = hasWhereForced(built.forced) ? stripUniqueWhereForcedInput(
-            bodyWhere,
-            built.forced
-          ) : { ...bodyWhere };
+          const bodyWhereObj = { ...bodyWhere };
+          const sanitized = hasWhereForced(built.forced) ? stripUniqueWhereForcedInput(bodyWhereObj, built.forced) : bodyWhereObj;
           try {
             result = built.schema.parse(sanitized);
           } catch (err) {
@@ -5198,11 +5247,9 @@ function createModelGuardExtension(config) {
           }
         }
       } else if (bodyWhere !== void 0 && bodyWhere !== null) {
-        if (isPlainObject(bodyWhere)) {
-          const sanitized = hasWhereForced(built.forced) ? stripUniqueWhereForcedInput(
-            bodyWhere,
-            built.forced
-          ) : { ...bodyWhere };
+        if (isObjectLike(bodyWhere)) {
+          const bodyWhereObj = { ...bodyWhere };
+          const sanitized = hasWhereForced(built.forced) ? stripUniqueWhereForcedInput(bodyWhereObj, built.forced) : bodyWhereObj;
           if (Object.keys(sanitized).length > 0) {
             throw new ShapeError(
               `Unique where on model "${modelName}" contains only forced values. Client where input is not accepted.`
@@ -5210,7 +5257,7 @@ function createModelGuardExtension(config) {
           }
         } else {
           throw new ShapeError(
-            `Invalid "where" on model "${modelName}": unique where must be a plain object`
+            `Invalid "where" on model "${modelName}": unique where must be an object`
           );
         }
       }
@@ -5563,12 +5610,7 @@ function createModelGuardExtension(config) {
           "upsert",
           "shape"
         );
-        validateAllowedKeys(
-          resolved.body,
-          allowedBodyKeys,
-          "upsert",
-          "body"
-        );
+        validateAllowedKeys(resolved.body, allowedBodyKeys, "upsert", "body");
         validateUniqueWhereShapeConfig(
           modelName,
           resolved.shape.where,