prisma-guard 1.32.1 → 1.33.0

package/dist/runtime/index.js

@@ -196,7 +196,7 @@ function isJsonSafe(value) {
   }
   return true;
 }
-var DECIMAL_REGEX = /^-?(\d+\.?\d*|\.\d+)([eE]-?\d+)?$/;
+var DECIMAL_REGEX = /^-?(\d+\.?\d*|\.\d+)([eE][+-]?\d+)?$/;
 var decimalStringSchema = z.string().refine((s) => DECIMAL_REGEX.test(s), "Invalid decimal string");
 var decimalObjectSchema = z.custom(
   (v) => v !== null && typeof v === "object" && typeof v.toFixed === "function" && typeof v.toNumber === "function",
@@ -956,8 +956,13 @@ function matchVariantPatterns(keys, caller) {
       continue;
     let matchesCaller = true;
     for (let index = 0; index < patternParts.length; index++) {
-      if (patternParts[index].startsWith(":"))
+      if (patternParts[index].startsWith(":")) {
+        if (callerParts[index].length === 0) {
+          matchesCaller = false;
+          break;
+        }
         continue;
+      }
       if (patternParts[index] !== callerParts[index]) {
         matchesCaller = false;
         break;
@@ -1052,8 +1057,12 @@ function deepClone(value) {
     case "object": {
       if (value instanceof Date)
         return new Date(value.getTime());
-      if (value instanceof Uint8Array)
+      if (value instanceof Uint8Array) {
+        if (typeof Buffer !== "undefined" && Buffer.isBuffer?.(value)) {
+          return Buffer.from(value);
+        }
         return value.slice();
+      }
       if (value instanceof RegExp)
         return new RegExp(value.source, value.flags);
       if (Array.isArray(value))
@@ -1063,7 +1072,17 @@ function deepClone(value) {
         return value;
       const result = {};
       for (const [k, v] of Object.entries(value)) {
-        result[k] = deepClone(v);
+        const cloned = deepClone(v);
+        if (k === "__proto__") {
+          Object.defineProperty(result, k, {
+            value: cloned,
+            enumerable: true,
+            writable: true,
+            configurable: true
+          });
+        } else {
+          result[k] = cloned;
+        }
       }
       return result;
     }
@@ -1073,6 +1092,9 @@ function deepClone(value) {
 }
 
 // src/shared/deep-equal.ts
+function isDecimalLike(v) {
+  return v !== null && typeof v === "object" && typeof v.toFixed === "function" && typeof v.toNumber === "function";
+}
 function deepEqual(a, b) {
   if (a === b)
     return true;
@@ -1098,6 +1120,28 @@ function deepEqual(a, b) {
   }
   if (a instanceof RegExp || b instanceof RegExp)
     return false;
+  if (a instanceof Uint8Array || b instanceof Uint8Array) {
+    if (!(a instanceof Uint8Array) || !(b instanceof Uint8Array))
+      return false;
+    if (a.byteLength !== b.byteLength)
+      return false;
+    for (let i = 0; i < a.byteLength; i++) {
+      if (a[i] !== b[i])
+        return false;
+    }
+    return true;
+  }
+  if (isDecimalLike(a) || isDecimalLike(b)) {
+    if (!isDecimalLike(a) || !isDecimalLike(b))
+      return false;
+    try {
+      if (typeof a.equals === "function")
+        return a.equals(b) === true;
+      return a.toString() === b.toString();
+    } catch {
+      return false;
+    }
+  }
   if (Array.isArray(a)) {
     if (!Array.isArray(b))
       return false;
@@ -2202,8 +2246,27 @@ function createWhereBuilder(typeMap, enumMap, scalarBase, uniqueMap = {}) {
       );
       forcedOnlyKeys.add(key);
     }
+    const selectorKeys = Object.keys(fieldSchemas);
+    let schema;
+    if (selectorKeys.length === 0) {
+      schema = null;
+    } else if (selectorKeys.length === 1) {
+      schema = z5.object(fieldSchemas).strict();
+    } else {
+      const optionalSchemas = {};
+      for (const [k, s] of Object.entries(fieldSchemas)) {
+        optionalSchemas[k] = s.optional();
+      }
+      const objectSchema = z5.object(optionalSchemas).strict();
+      schema = Object.keys(forcedConditions).length > 0 ? objectSchema : objectSchema.refine(
+        (v) => selectorKeys.some((k) => v[k] !== void 0),
+        {
+          message: `Unique where for model "${model}" must specify at least one selector: ${selectorKeys.join(", ")}`
+        }
+      );
+    }
     return {
-      schema: Object.keys(fieldSchemas).length > 0 ? z5.object(fieldSchemas).strict() : null,
+      schema,
       forced: {
         conditions: forcedConditions,
         relations: {}
@@ -3664,6 +3727,12 @@ function pickMissingFksFromResult(result, fks) {
   return missing;
 }
 function validateScopeValue(root, value) {
+  const t = typeof value;
+  if (t !== "string" && t !== "number" && t !== "bigint") {
+    throw new PolicyError(
+      `Non-primitive scope value for root "${root}" (${t}). Only string, number, and bigint are accepted \u2014 an object or array here would silently become a Prisma filter and could bypass scope isolation.`
+    );
+  }
   if (typeof value === "string" && value.length === 0) {
     throw new PolicyError(
       `Empty string scope value for root "${root}". This is almost certainly a bug in the context function.`
@@ -3706,10 +3775,12 @@ function enforceDataScope(data, scopes, overrides, log, model, operation, onScop
 }
 var VALID_FIND_UNIQUE_MODES = /* @__PURE__ */ new Set(["verify", "reject"]);
 var VALID_ON_SCOPE_RELATION_WRITES = /* @__PURE__ */ new Set(["error", "warn", "strip"]);
+var VALID_ON_MISSING_SCOPE_CONTEXT = /* @__PURE__ */ new Set(["error", "warn", "ignore"]);
 function createScopeExtension(scopeMap, contextFn, guardConfig, logger) {
   const log = logger ?? { warn: (msg) => console.warn(msg) };
   const findUniqueMode = guardConfig.findUniqueMode ?? "reject";
   const onScopeRelationWrite = guardConfig.onScopeRelationWrite ?? "error";
+  const onMissingScopeContext = guardConfig.onMissingScopeContext ?? "error";
   if (!VALID_FIND_UNIQUE_MODES.has(findUniqueMode)) {
     throw new ShapeError(
       `prisma-guard: Invalid findUniqueMode "${findUniqueMode}". Allowed: ${[...VALID_FIND_UNIQUE_MODES].join(", ")}`
@@ -3720,6 +3791,11 @@ function createScopeExtension(scopeMap, contextFn, guardConfig, logger) {
       `prisma-guard: Invalid onScopeRelationWrite "${onScopeRelationWrite}". Allowed: ${[...VALID_ON_SCOPE_RELATION_WRITES].join(", ")}`
     );
   }
+  if (!VALID_ON_MISSING_SCOPE_CONTEXT.has(onMissingScopeContext)) {
+    throw new ShapeError(
+      `prisma-guard: Invalid onMissingScopeContext "${onMissingScopeContext}". Allowed: ${[...VALID_ON_MISSING_SCOPE_CONTEXT].join(", ")}`
+    );
+  }
   const scopeFkSets = /* @__PURE__ */ new Map();
   for (const [model, entries] of Object.entries(scopeMap)) {
     const fks = /* @__PURE__ */ new Set();
@@ -3745,12 +3821,12 @@ function createScopeExtension(scopeMap, contextFn, guardConfig, logger) {
         const missingRoots = scopes.filter((s) => ctx[s.root] == null).map((s) => s.root);
         const isMutation = CREATE_OPS.has(operation) || UNIQUE_MUTATION_OPS.has(operation) || MULTI_MUTATION_OPS.has(operation) || operation === "upsert";
         if (missingRoots.length > 0) {
-          if (isMutation || guardConfig.onMissingScopeContext === "error") {
+          if (isMutation || onMissingScopeContext === "error") {
             throw new PolicyError(
               `prisma-guard: Missing scope context for model "${model}": roots ${missingRoots.map((r) => `"${r}"`).join(", ")} not provided. All scope roots must be present.`
             );
           }
-          if (guardConfig.onMissingScopeContext === "warn") {
+          if (onMissingScopeContext === "warn") {
             log.warn(
               `prisma-guard: Missing scope context for model "${model}": roots ${missingRoots.map((r) => `"${r}"`).join(", ")} not provided. Read proceeding with partial scope.`
             );