prisma-guard 1.30.0 → 1.32.0

package/dist/runtime/index.d.cts

@@ -13,6 +13,7 @@ interface FieldMeta {
     isEnum?: boolean;
     isUnique?: boolean;
     isUnsupported?: boolean;
+    relationFromFields?: readonly string[];
 }
 interface GuardLogger {
     warn(message: string): void;
@@ -228,6 +229,7 @@ interface FieldMetaConst {
     readonly isEnum?: boolean;
     readonly isUnique?: boolean;
     readonly isUnsupported?: boolean;
+    readonly relationFromFields?: readonly string[];
 }
 interface UniqueConstraintConst {
     readonly selector: string;

package/dist/runtime/index.d.ts

@@ -13,6 +13,7 @@ interface FieldMeta {
     isEnum?: boolean;
     isUnique?: boolean;
     isUnsupported?: boolean;
+    relationFromFields?: readonly string[];
 }
 interface GuardLogger {
     warn(message: string): void;
@@ -228,6 +229,7 @@ interface FieldMetaConst {
     readonly isEnum?: boolean;
     readonly isUnique?: boolean;
     readonly isUnsupported?: boolean;
+    readonly relationFromFields?: readonly string[];
 }
 interface UniqueConstraintConst {
     readonly selector: string;

package/dist/runtime/index.js

@@ -944,40 +944,75 @@ function unsupported() {
   return marker;
 }
 
-// src/shared/match-caller.ts
-function matchCallerPattern(patterns, caller) {
-  if (typeof caller !== "string" || caller.trim().length === 0)
-    return null;
-  if (patterns.includes(caller))
-    return caller;
+// src/shared/guard-variant-routing.ts
+function matchVariantPatterns(keys, caller) {
+  const callerParts = caller.split("/");
   const matches = [];
-  for (const pattern of patterns) {
+  for (const pattern of keys) {
     if (!pattern.includes(":"))
       continue;
     const patternParts = pattern.split("/");
-    const callerParts = caller.split("/");
     if (patternParts.length !== callerParts.length)
       continue;
-    let ok = true;
-    for (let i = 0; i < patternParts.length; i++) {
-      if (patternParts[i].startsWith(":"))
+    let matchesCaller = true;
+    for (let index = 0; index < patternParts.length; index++) {
+      if (patternParts[index].startsWith(":"))
         continue;
-      if (patternParts[i] !== callerParts[i]) {
-        ok = false;
+      if (patternParts[index] !== callerParts[index]) {
+        matchesCaller = false;
         break;
       }
     }
-    if (ok)
+    if (matchesCaller)
       matches.push(pattern);
   }
-  if (matches.length === 0)
-    return null;
+  return matches;
+}
+function resolveGuardVariantKey(input) {
+  if (input.kind === "single") {
+    return { ok: true, key: "_default" };
+  }
+  const { keys, caller, reservedKeys } = input;
+  for (const key of keys) {
+    if (reservedKeys.has(key)) {
+      return {
+        ok: false,
+        code: "reserved-key",
+        key,
+        keys
+      };
+    }
+  }
+  const hasDefault = keys.includes("default");
+  if (typeof caller !== "string") {
+    if (hasDefault)
+      return { ok: true, key: "default" };
+    return { ok: false, code: "missing-caller", keys };
+  }
+  if (caller.trim().length === 0) {
+    if (hasDefault)
+      return { ok: true, key: "default" };
+    return { ok: false, code: "unknown-caller", caller, keys };
+  }
+  if (keys.includes(caller)) {
+    return { ok: true, key: caller };
+  }
+  const matches = matchVariantPatterns(keys, caller);
+  if (matches.length === 1) {
+    return { ok: true, key: matches[0] };
+  }
   if (matches.length > 1) {
-    throw new CallerError(
-      `Ambiguous caller "${caller}" matches multiple patterns: ${matches.map((p) => `"${p}"`).join(", ")}`
-    );
+    return {
+      ok: false,
+      code: "ambiguous-caller",
+      caller,
+      keys,
+      matches
+    };
   }
-  return matches[0];
+  if (hasDefault)
+    return { ok: true, key: "default" };
+  return { ok: false, code: "unknown-caller", caller, keys };
 }
 
 // src/runtime/policy.ts
@@ -3410,22 +3445,27 @@ function createQueryBuilder(typeMap, enumMap, uniqueMap, scalarBase) {
       forcedSelectCountWhere
     };
   }
-  function matchCaller(shapes, caller) {
-    const matched = matchCallerPattern(Object.keys(shapes), caller);
-    if (!matched)
-      return null;
-    return { key: matched, shape: shapes[matched] };
-  }
-  function resolveDefaultShape(config, model, method, normalizedBody, opts, builtCache, isUnique) {
-    const shapeOrFn = config.default;
-    let built;
-    if (typeof shapeOrFn === "function") {
-      const resolved = resolveAndValidateShape(shapeOrFn, opts?.ctx);
-      built = buildShapeZodSchema(model, method, resolved);
-    } else {
-      built = builtCache.get("default");
+  function throwQueryVariantResolution(resolution) {
+    const keys = resolution.keys.map((key) => `"${key}"`).join(", ");
+    if (resolution.code === "reserved-key") {
+      throw new ShapeError(
+        `Caller key "${resolution.key}" collides with reserved shape config key. Rename the caller path.`
+      );
+    }
+    if (resolution.code === "missing-caller") {
+      throw new CallerError(
+        `Missing caller. This query uses named shape routing with keys: ${keys}. Provide caller via opts.caller.`
+      );
     }
-    return applyBuiltShape(built, normalizedBody, isUnique);
+    if (resolution.code === "ambiguous-caller") {
+      const matches = (resolution.matches ?? []).map((pattern) => `"${pattern}"`).join(", ");
+      throw new CallerError(
+        `Ambiguous caller "${resolution.caller}" matches multiple patterns: ${matches}`
+      );
+    }
+    throw new CallerError(
+      `Unknown caller: "${resolution.caller}". Allowed: ${keys}`
+    );
   }
   function buildQuerySchema(model, method, config) {
     const isSingle = typeof config === "function" || isShapeConfig(config);
@@ -3437,12 +3477,15 @@ function createQueryBuilder(typeMap, enumMap, uniqueMap, scalarBase) {
       );
     }
     if (!isSingle) {
-      for (const key of Object.keys(config)) {
-        if (SHAPE_CONFIG_KEYS.has(key)) {
-          throw new ShapeError(
-            `Caller key "${key}" collides with reserved shape config key. Rename the caller path.`
-          );
-        }
+      const keys = Object.keys(config);
+      const validation = resolveGuardVariantKey({
+        kind: "named",
+        keys,
+        caller: void 0,
+        reservedKeys: SHAPE_CONFIG_KEYS
+      });
+      if (!validation.ok && validation.code === "reserved-key") {
+        throwQueryVariantResolution(validation);
       }
       for (const [key, shapeOrFn] of Object.entries(
         config
@@ -3480,47 +3523,20 @@ function createQueryBuilder(typeMap, enumMap, uniqueMap, scalarBase) {
             );
           }
           const namedConfig = config;
-          const caller = opts?.caller;
-          if (typeof caller !== "string") {
-            if ("default" in namedConfig) {
-              return resolveDefaultShape(
-                namedConfig,
-                model,
-                method,
-                normalizedBody,
-                opts,
-                builtCache,
-                isUnique
-              );
-            }
-            const allowed = Object.keys(namedConfig);
-            throw new CallerError(
-              `Missing caller. This query uses named shape routing with keys: ${allowed.map((k) => `"${k}"`).join(", ")}. Provide caller via opts.caller.`
-            );
-          }
-          const matched = matchCaller(namedConfig, caller);
-          if (!matched) {
-            if ("default" in namedConfig) {
-              return resolveDefaultShape(
-                namedConfig,
-                model,
-                method,
-                normalizedBody,
-                opts,
-                builtCache,
-                isUnique
-              );
-            }
-            const allowed = Object.keys(namedConfig);
-            throw new CallerError(
-              `Unknown caller: "${caller}". Allowed: ${allowed.map((k) => `"${k}"`).join(", ")}`
-            );
-          }
-          if (typeof matched.shape === "function") {
-            const resolved = resolveAndValidateShape(matched.shape, opts?.ctx);
+          const resolution = resolveGuardVariantKey({
+            kind: "named",
+            keys: Object.keys(namedConfig),
+            caller: opts?.caller,
+            reservedKeys: SHAPE_CONFIG_KEYS
+          });
+          if (!resolution.ok)
+            throwQueryVariantResolution(resolution);
+          const shapeOrFn = namedConfig[resolution.key];
+          if (typeof shapeOrFn === "function") {
+            const resolved = resolveAndValidateShape(shapeOrFn, opts?.ctx);
             built = buildShapeZodSchema(model, method, resolved);
           } else {
-            built = builtCache.get(matched.key);
+            built = builtCache.get(resolution.key);
           }
         }
         return applyBuiltShape(built, normalizedBody, isUnique);
@@ -4110,12 +4126,39 @@ function validateAllowedKeys(value, allowed, method, kind) {
     return `Shape key "${key}" not valid for ${method}. Allowed: ${[...allowed].join(", ")}`;
   });
 }
+var RELATION_OPS_COVERING_FK = /* @__PURE__ */ new Set([
+  "connect",
+  "connectOrCreate",
+  "create"
+]);
+function collectRelationCoveredFks(modelFields, dataConfig) {
+  const covered = /* @__PURE__ */ new Set();
+  for (const [fieldName, value] of Object.entries(dataConfig)) {
+    const meta = modelFields[fieldName];
+    if (!meta || !meta.isRelation)
+      continue;
+    const fks = meta.relationFromFields;
+    if (!fks || fks.length === 0)
+      continue;
+    if (!isPlainObject(value))
+      continue;
+    const covers = Object.keys(value).some(
+      (op) => RELATION_OPS_COVERING_FK.has(op)
+    );
+    if (!covers)
+      continue;
+    for (const fk of fks)
+      covered.add(fk);
+  }
+  return covered;
+}
 function validateCreateCompleteness(modelName, dataConfig, typeMap, scopeFks, zodDefaults) {
   const modelFields = typeMap[modelName];
   if (!modelFields)
     return;
   const zodDefaultFields = zodDefaults[modelName];
   const zodDefaultSet = zodDefaultFields ? new Set(zodDefaultFields) : void 0;
+  const relationCoveredFks = collectRelationCoveredFks(modelFields, dataConfig);
   for (const [fieldName, meta] of Object.entries(modelFields)) {
     if (meta.isRelation)
       continue;
@@ -4129,10 +4172,12 @@ function validateCreateCompleteness(modelName, dataConfig, typeMap, scopeFks, zo
       continue;
     if (scopeFks.has(fieldName))
       continue;
+    if (relationCoveredFks.has(fieldName))
+      continue;
     if (zodDefaultSet && zodDefaultSet.has(fieldName))
       continue;
     throw new ShapeError(
-      `Required field "${fieldName}" on model "${modelName}" is missing from create data shape, has no default, and is not a scope FK`
+      `Required field "${fieldName}" on model "${modelName}" is missing from create data shape, has no default, is not a scope FK, and is not covered by a relation write in the shape`
     );
   }
 }
@@ -4726,34 +4771,43 @@ function resolveDynamicShape(shapeFn, ctx, context) {
   }
   return result;
 }
-function resolveNamedShape(input, body, contextFn, explicitCaller) {
-  assertNoCallerInBody(body);
-  const caller = explicitCaller;
-  const keys = Object.keys(input);
-  for (const key of keys) {
-    if (GUARD_SHAPE_KEYS.has(key)) {
-      throw new ShapeError(
-        `Caller key "${key}" collides with reserved guard shape key. Rename the caller path.`
-      );
-    }
+function throwVariantResolution(resolution) {
+  const keys = resolution.keys.map((key) => `"${key}"`).join(", ");
+  if (resolution.code === "reserved-key") {
+    throw new ShapeError(
+      `Caller key "${resolution.key}" collides with reserved guard shape key. Rename the caller path.`
+    );
   }
-  if (typeof caller !== "string") {
-    if ("default" in input) {
-      return resolveShapeEntry(input.default, body, contextFn, "default");
-    }
+  if (resolution.code === "missing-caller") {
     throw new CallerError(
-      `Missing caller. This guard uses named shape routing with keys: ${keys.map((k) => `"${k}"`).join(", ")}. Provide caller via guard(input, caller).`
+      `Missing caller. This guard uses named shape routing with keys: ${keys}. Provide caller via guard(input, caller).`
     );
   }
-  const matched = matchCallerPattern(keys, caller);
-  if (matched) {
-    return resolveShapeEntry(input[matched], body, contextFn, matched);
-  }
-  if ("default" in input) {
-    return resolveShapeEntry(input.default, body, contextFn, "default");
+  if (resolution.code === "ambiguous-caller") {
+    const matches = (resolution.matches ?? []).map((pattern) => `"${pattern}"`).join(", ");
+    throw new CallerError(
+      `Ambiguous caller "${resolution.caller}" matches multiple patterns: ${matches}`
+    );
   }
   throw new CallerError(
-    `Unknown caller: "${caller}". Allowed: ${keys.map((k) => `"${k}"`).join(", ")}`
+    `Unknown caller: "${resolution.caller}". Allowed: ${keys}`
+  );
+}
+function resolveNamedShape(input, body, contextFn, explicitCaller) {
+  assertNoCallerInBody(body);
+  const resolution = resolveGuardVariantKey({
+    kind: "named",
+    keys: Object.keys(input),
+    caller: explicitCaller,
+    reservedKeys: GUARD_SHAPE_KEYS
+  });
+  if (!resolution.ok)
+    throwVariantResolution(resolution);
+  return resolveShapeEntry(
+    input[resolution.key],
+    body,
+    contextFn,
+    resolution.key
   );
 }
 function resolveShapeEntry(entry, body, contextFn, matchedKey) {