prisma-guard 1.32.0 → 1.33.0

package/dist/runtime/index.js

@@ -196,7 +196,7 @@ function isJsonSafe(value) {
   }
   return true;
 }
-var DECIMAL_REGEX = /^-?(\d+\.?\d*|\.\d+)([eE]-?\d+)?$/;
+var DECIMAL_REGEX = /^-?(\d+\.?\d*|\.\d+)([eE][+-]?\d+)?$/;
 var decimalStringSchema = z.string().refine((s) => DECIMAL_REGEX.test(s), "Invalid decimal string");
 var decimalObjectSchema = z.custom(
   (v) => v !== null && typeof v === "object" && typeof v.toFixed === "function" && typeof v.toNumber === "function",
@@ -956,8 +956,13 @@ function matchVariantPatterns(keys, caller) {
       continue;
     let matchesCaller = true;
     for (let index = 0; index < patternParts.length; index++) {
-      if (patternParts[index].startsWith(":"))
+      if (patternParts[index].startsWith(":")) {
+        if (callerParts[index].length === 0) {
+          matchesCaller = false;
+          break;
+        }
         continue;
+      }
       if (patternParts[index] !== callerParts[index]) {
         matchesCaller = false;
         break;
@@ -1052,8 +1057,12 @@ function deepClone(value) {
     case "object": {
       if (value instanceof Date)
         return new Date(value.getTime());
-      if (value instanceof Uint8Array)
+      if (value instanceof Uint8Array) {
+        if (typeof Buffer !== "undefined" && Buffer.isBuffer?.(value)) {
+          return Buffer.from(value);
+        }
         return value.slice();
+      }
       if (value instanceof RegExp)
         return new RegExp(value.source, value.flags);
       if (Array.isArray(value))
@@ -1063,7 +1072,17 @@ function deepClone(value) {
         return value;
       const result = {};
       for (const [k, v] of Object.entries(value)) {
-        result[k] = deepClone(v);
+        const cloned = deepClone(v);
+        if (k === "__proto__") {
+          Object.defineProperty(result, k, {
+            value: cloned,
+            enumerable: true,
+            writable: true,
+            configurable: true
+          });
+        } else {
+          result[k] = cloned;
+        }
       }
       return result;
     }
@@ -1073,6 +1092,9 @@ function deepClone(value) {
 }
 
 // src/shared/deep-equal.ts
+function isDecimalLike(v) {
+  return v !== null && typeof v === "object" && typeof v.toFixed === "function" && typeof v.toNumber === "function";
+}
 function deepEqual(a, b) {
   if (a === b)
     return true;
@@ -1098,6 +1120,28 @@ function deepEqual(a, b) {
   }
   if (a instanceof RegExp || b instanceof RegExp)
     return false;
+  if (a instanceof Uint8Array || b instanceof Uint8Array) {
+    if (!(a instanceof Uint8Array) || !(b instanceof Uint8Array))
+      return false;
+    if (a.byteLength !== b.byteLength)
+      return false;
+    for (let i = 0; i < a.byteLength; i++) {
+      if (a[i] !== b[i])
+        return false;
+    }
+    return true;
+  }
+  if (isDecimalLike(a) || isDecimalLike(b)) {
+    if (!isDecimalLike(a) || !isDecimalLike(b))
+      return false;
+    try {
+      if (typeof a.equals === "function")
+        return a.equals(b) === true;
+      return a.toString() === b.toString();
+    } catch {
+      return false;
+    }
+  }
   if (Array.isArray(a)) {
     if (!Array.isArray(b))
       return false;
@@ -1486,12 +1530,15 @@ function applyForcedCountWhere(container, forcedCountWhere) {
 }
 function resolvedWhereCoversConstraint(where, constraint) {
   if (constraint.fields.length === 1) {
-    return constraint.fields[0] in where;
+    const value2 = where[constraint.fields[0]];
+    return value2 !== null && value2 !== void 0;
   }
   const value = where[constraint.selector];
   if (!isPlainObject(value))
     return false;
-  return constraint.fields.every((field) => field in value);
+  return constraint.fields.every(
+    (field) => value[field] !== null && value[field] !== void 0
+  );
 }
 function validateResolvedUniqueWhere(model, where, method, uniqueMap) {
   const constraints = uniqueMap[model];
@@ -1518,17 +1565,16 @@ function assertDirectUniqueShapeValue(model, field, value, typeMap) {
       );
     }
   }
-  if (isForcedValue(value))
-    return;
-  if (isPlainObject(value)) {
-    const keys = Object.keys(value);
+  const actual = isForcedValue(value) ? value.value : value;
+  if (isPlainObject(actual)) {
+    const keys = Object.keys(actual);
     throw new ShapeError(
       `Invalid unique where shape for "${model ?? "unknown"}.${field}". Prisma WhereUniqueInput does not accept filter operator objects${keys.length ? `: ${keys.join(", ")}` : ""}. Use { ${field}: true } in guard shape and { ${field}: value } in request args.`
     );
   }
-  if (value === null || value === void 0) {
+  if (actual === null || actual === void 0) {
     throw new ShapeError(
-      `Invalid unique where shape for "${model ?? "unknown"}.${field}". Unique fields must use true or a forced value.`
+      `Invalid unique where shape for "${model ?? "unknown"}.${field}". Unique fields must use true or a forced non-null value.`
     );
   }
 }
@@ -1542,9 +1588,8 @@ function shapeCoversConstraint(where, constraint, model, typeMap) {
   }
   if (!(constraint.selector in where))
     return false;
-  const selectorValue = where[constraint.selector];
-  if (isForcedValue(selectorValue))
-    return true;
+  const rawSelectorValue = where[constraint.selector];
+  const selectorValue = isForcedValue(rawSelectorValue) ? rawSelectorValue.value : rawSelectorValue;
   if (!isPlainObject(selectorValue)) {
     throw new ShapeError(
       `Compound unique selector "${model}.${constraint.selector}" must be an object with fields: ${constraint.fields.join(", ")}`
@@ -2047,8 +2092,18 @@ function createWhereBuilder(typeMap, enumMap, scalarBase, uniqueMap = {}) {
       (constraint) => constraint.selector === selector
     ) ?? null;
   }
-  function parseForcedUniqueValue(model, fieldName, fieldMeta, value) {
+  function buildUniqueWhereFieldSchema(fieldMeta, allowNullableFilter) {
     const schema = buildDirectScalarSchema(fieldMeta, enumMap, scalarBase);
+    if (allowNullableFilter && !fieldMeta.isRequired) {
+      return schema.nullable();
+    }
+    return schema;
+  }
+  function parseForcedUniqueValue(model, fieldName, fieldMeta, value, allowNullableFilter) {
+    const schema = buildUniqueWhereFieldSchema(
+      fieldMeta,
+      allowNullableFilter
+    );
     const actual = isForcedValue(value) ? value.value : value;
     try {
       return schema.parse(actual);
@@ -2126,10 +2181,9 @@ function createWhereBuilder(typeMap, enumMap, scalarBase, uniqueMap = {}) {
               `Invalid compound unique where shape for "${model}.${key}.${fieldName}". Prisma compound unique selectors do not accept filter operator objects${operators.length ? `: ${operators.join(", ")}` : ""}. Use direct values only.`
             );
           }
-          const directSchema2 = buildDirectScalarSchema(
+          const directSchema2 = buildUniqueWhereFieldSchema(
             fieldMeta2,
-            enumMap,
-            scalarBase
+            false
           );
           if (fieldValue === true) {
             nestedSchemas[fieldName] = directSchema2;
@@ -2138,7 +2192,8 @@ function createWhereBuilder(typeMap, enumMap, scalarBase, uniqueMap = {}) {
               model,
               fieldName,
               fieldMeta2,
-              fieldValue
+              fieldValue,
+              false
             );
           }
         }
@@ -2177,7 +2232,7 @@ function createWhereBuilder(typeMap, enumMap, scalarBase, uniqueMap = {}) {
           `Invalid unique where shape for "${model}.${key}". Prisma WhereUniqueInput does not accept operators: ${keys.join(", ")}. Use a direct unique value shape, for example { ${key}: true }.`
         );
       }
-      const directSchema = buildDirectScalarSchema(fieldMeta, enumMap, scalarBase);
+      const directSchema = buildUniqueWhereFieldSchema(fieldMeta, true);
       if (value === true) {
         fieldSchemas[key] = directSchema;
         continue;
@@ -2186,12 +2241,32 @@ function createWhereBuilder(typeMap, enumMap, scalarBase, uniqueMap = {}) {
         model,
         key,
         fieldMeta,
-        value
+        value,
+        true
       );
       forcedOnlyKeys.add(key);
     }
+    const selectorKeys = Object.keys(fieldSchemas);
+    let schema;
+    if (selectorKeys.length === 0) {
+      schema = null;
+    } else if (selectorKeys.length === 1) {
+      schema = z5.object(fieldSchemas).strict();
+    } else {
+      const optionalSchemas = {};
+      for (const [k, s] of Object.entries(fieldSchemas)) {
+        optionalSchemas[k] = s.optional();
+      }
+      const objectSchema = z5.object(optionalSchemas).strict();
+      schema = Object.keys(forcedConditions).length > 0 ? objectSchema : objectSchema.refine(
+        (v) => selectorKeys.some((k) => v[k] !== void 0),
+        {
+          message: `Unique where for model "${model}" must specify at least one selector: ${selectorKeys.join(", ")}`
+        }
+      );
+    }
     return {
-      schema: Object.keys(fieldSchemas).length > 0 ? z5.object(fieldSchemas).strict() : null,
+      schema,
       forced: {
         conditions: forcedConditions,
         relations: {}
@@ -3539,7 +3614,21 @@ function createQueryBuilder(typeMap, enumMap, uniqueMap, scalarBase) {
             built = builtCache.get(resolution.key);
           }
         }
-        return applyBuiltShape(built, normalizedBody, isUnique);
+        const result = applyBuiltShape(
+          built,
+          normalizedBody,
+          isUnique,
+          model
+        );
+        if (isUnique && result.where) {
+          validateResolvedUniqueWhere(
+            model,
+            result.where,
+            method,
+            uniqueMap
+          );
+        }
+        return result;
       }
     };
   }
@@ -3638,6 +3727,12 @@ function pickMissingFksFromResult(result, fks) {
   return missing;
 }
 function validateScopeValue(root, value) {
+  const t = typeof value;
+  if (t !== "string" && t !== "number" && t !== "bigint") {
+    throw new PolicyError(
+      `Non-primitive scope value for root "${root}" (${t}). Only string, number, and bigint are accepted \u2014 an object or array here would silently become a Prisma filter and could bypass scope isolation.`
+    );
+  }
   if (typeof value === "string" && value.length === 0) {
     throw new PolicyError(
       `Empty string scope value for root "${root}". This is almost certainly a bug in the context function.`
@@ -3680,10 +3775,12 @@ function enforceDataScope(data, scopes, overrides, log, model, operation, onScop
 }
 var VALID_FIND_UNIQUE_MODES = /* @__PURE__ */ new Set(["verify", "reject"]);
 var VALID_ON_SCOPE_RELATION_WRITES = /* @__PURE__ */ new Set(["error", "warn", "strip"]);
+var VALID_ON_MISSING_SCOPE_CONTEXT = /* @__PURE__ */ new Set(["error", "warn", "ignore"]);
 function createScopeExtension(scopeMap, contextFn, guardConfig, logger) {
   const log = logger ?? { warn: (msg) => console.warn(msg) };
   const findUniqueMode = guardConfig.findUniqueMode ?? "reject";
   const onScopeRelationWrite = guardConfig.onScopeRelationWrite ?? "error";
+  const onMissingScopeContext = guardConfig.onMissingScopeContext ?? "error";
   if (!VALID_FIND_UNIQUE_MODES.has(findUniqueMode)) {
     throw new ShapeError(
       `prisma-guard: Invalid findUniqueMode "${findUniqueMode}". Allowed: ${[...VALID_FIND_UNIQUE_MODES].join(", ")}`
@@ -3694,6 +3791,11 @@ function createScopeExtension(scopeMap, contextFn, guardConfig, logger) {
       `prisma-guard: Invalid onScopeRelationWrite "${onScopeRelationWrite}". Allowed: ${[...VALID_ON_SCOPE_RELATION_WRITES].join(", ")}`
     );
   }
+  if (!VALID_ON_MISSING_SCOPE_CONTEXT.has(onMissingScopeContext)) {
+    throw new ShapeError(
+      `prisma-guard: Invalid onMissingScopeContext "${onMissingScopeContext}". Allowed: ${[...VALID_ON_MISSING_SCOPE_CONTEXT].join(", ")}`
+    );
+  }
   const scopeFkSets = /* @__PURE__ */ new Map();
   for (const [model, entries] of Object.entries(scopeMap)) {
     const fks = /* @__PURE__ */ new Set();
@@ -3719,12 +3821,12 @@ function createScopeExtension(scopeMap, contextFn, guardConfig, logger) {
         const missingRoots = scopes.filter((s) => ctx[s.root] == null).map((s) => s.root);
         const isMutation = CREATE_OPS.has(operation) || UNIQUE_MUTATION_OPS.has(operation) || MULTI_MUTATION_OPS.has(operation) || operation === "upsert";
         if (missingRoots.length > 0) {
-          if (isMutation || guardConfig.onMissingScopeContext === "error") {
+          if (isMutation || onMissingScopeContext === "error") {
             throw new PolicyError(
               `prisma-guard: Missing scope context for model "${model}": roots ${missingRoots.map((r) => `"${r}"`).join(", ")} not provided. All scope roots must be present.`
             );
           }
-          if (guardConfig.onMissingScopeContext === "warn") {
+          if (onMissingScopeContext === "warn") {
             log.warn(
               `prisma-guard: Missing scope context for model "${model}": roots ${missingRoots.map((r) => `"${r}"`).join(", ")} not provided. Read proceeding with partial scope.`
             );