prisma-safe-ai-query 1.0.6 → 2.0.0

package/dist/engine.js

@@ -2,6 +2,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.PrismaAIEngine = void 0;
 const schema_1 = require("./schema");
+const NUMERIC_FIELD_HEURISTIC = /(?:^id$|Id$|^age$|^count$|^total$|^amount$|^price$|^quantity$|^score$|^level$|^page$|^limit$)/;
 class PrismaAIEngine {
     static matchesSecurityRule(value, rule) {
         const normalizedValue = value.trim();
@@ -9,92 +10,411 @@ class PrismaAIEngine {
         if (!normalizedValue || !normalizedRule) {
             return false;
         }
-        return normalizedValue === normalizedRule || normalizedValue.startsWith(`${normalizedRule}.`);
+        return (normalizedValue === normalizedRule ||
+            normalizedValue.startsWith(`${normalizedRule}.`));
     }
-    static normalizeFilterValue(filter) {
-        const { operator, value } = filter;
-        if (operator === 'in' || operator === 'notIn') {
+    static validatePath(pathStr, config, entityType = "field", rootTable) {
+        const normalizedPath = pathStr.trim();
+        if (!normalizedPath)
+            return;
+        const parts = normalizedPath.split(".");
+        const fieldLeaf = parts[parts.length - 1];
+        const tablePrefixedPath = rootTable &&
+            !normalizedPath.startsWith(`${rootTable}.`) &&
+            normalizedPath !== rootTable
+            ? `${rootTable}.${normalizedPath}`
+            : normalizedPath;
+        if (config?.blockList) {
+            const isBlocked = config.blockList.some((rule) => {
+                const trimmedRule = rule.trim();
+                return (this.matchesSecurityRule(normalizedPath, trimmedRule) ||
+                    this.matchesSecurityRule(tablePrefixedPath, trimmedRule) ||
+                    this.matchesSecurityRule(fieldLeaf, trimmedRule));
+            });
+            if (isBlocked) {
+                if (entityType === "table") {
+                    throw new Error(`Security Exception: AI attempted to query a blocked table -> ${normalizedPath}`);
+                }
+                throw new Error(`Security Exception: AI attempted to query a blocked table or field -> ${normalizedPath}`);
+            }
+        }
+        if (config?.allowList) {
+            if (entityType === "table") {
+                const isTableAllowed = config.allowList.some((rule) => {
+                    const trimmedRule = rule.trim();
+                    return (this.matchesSecurityRule(normalizedPath, trimmedRule) ||
+                        normalizedPath.toLowerCase() === trimmedRule.toLowerCase());
+                });
+                if (!isTableAllowed) {
+                    throw new Error(`Security Exception: AI attempted to query a non-allowlisted table -> ${normalizedPath}`);
+                }
+            }
+            else {
+                // For fields, check if the specific field path, prefixed path, or leaf is allowlisted
+                const isFieldAllowed = config.allowList.some((rule) => {
+                    const trimmedRule = rule.trim();
+                    return (this.matchesSecurityRule(normalizedPath, trimmedRule) ||
+                        this.matchesSecurityRule(fieldLeaf, trimmedRule));
+                });
+                if (!isFieldAllowed) {
+                    throw new Error(`Security Exception: AI attempted to query a non-allowlisted field -> ${normalizedPath}`);
+                }
+            }
+        }
+    }
+    static coerceScalarValue(val, expectedType, schema, fieldName) {
+        if (val === null || val === undefined)
+            return val;
+        if (expectedType) {
+            const lowerType = expectedType.toLowerCase();
+            if (lowerType === "int" || lowerType === "bigint") {
+                if (typeof val === "string") {
+                    const parsed = parseInt(val.trim(), 10);
+                    if (!isNaN(parsed))
+                        return parsed;
+                }
+                else if (typeof val === "number") {
+                    return Math.round(val);
+                }
+            }
+            else if (lowerType === "float" || lowerType === "decimal") {
+                if (typeof val === "string") {
+                    const parsed = parseFloat(val.trim());
+                    if (!isNaN(parsed))
+                        return parsed;
+                }
+            }
+            else if (lowerType === "boolean") {
+                if (typeof val === "string") {
+                    const trimmed = val.trim().toLowerCase();
+                    if (trimmed === "true")
+                        return true;
+                    if (trimmed === "false")
+                        return false;
+                }
+            }
+            else if (lowerType === "datetime") {
+                if (typeof val === "string" && val.trim()) {
+                    const d = new Date(val.trim());
+                    if (!isNaN(d.getTime()))
+                        return d;
+                }
+            }
+            else if (schema?.enums?.length && typeof val === "string") {
+                // Case-insensitive Enum matching (e.g. "inactive" -> "INACTIVE")
+                const enumDef = schema.enums.find((e) => e.name.toLowerCase() === lowerType);
+                if (enumDef) {
+                    const trimmedVal = val.trim();
+                    const matchedEnumVal = enumDef.values.find((v) => v.toLowerCase() === trimmedVal.toLowerCase());
+                    if (matchedEnumVal) {
+                        return matchedEnumVal;
+                    }
+                }
+            }
+        }
+        else {
+            // Heuristic fallback when schema type is not provided:
+            // Only coerce numeric strings for likely numeric column names (id, userId, age, count, etc.)
+            if (typeof val === "string") {
+                const trimmed = val.trim();
+                const leafName = fieldName ? fieldName.split(".").pop() || "" : "";
+                if (/^-?\d+$/.test(trimmed) &&
+                    (!leafName || NUMERIC_FIELD_HEURISTIC.test(leafName))) {
+                    const parsed = parseInt(trimmed, 10);
+                    if (Number.isSafeInteger(parsed))
+                        return parsed;
+                }
+                else if (trimmed.toLowerCase() === "true") {
+                    return true;
+                }
+                else if (trimmed.toLowerCase() === "false") {
+                    return false;
+                }
+            }
+        }
+        return val;
+    }
+    static normalizeFilterValue(filter, expectedType, schema) {
+        const { field, operator, value } = filter;
+        if (operator === "in" || operator === "notIn") {
+            let rawList = [];
             if (Array.isArray(value)) {
-                return value;
+                rawList = value;
             }
-            if (typeof value === 'string') {
+            else if (typeof value === "string") {
                 const trimmed = value.trim();
                 if (!trimmed) {
                     return [];
                 }
-                if (trimmed.startsWith('[') && trimmed.endsWith(']')) {
+                if (trimmed.startsWith("[") && trimmed.endsWith("]")) {
                     try {
                         const parsed = JSON.parse(trimmed);
-                        return Array.isArray(parsed) ? parsed : [parsed];
+                        rawList = Array.isArray(parsed) ? parsed : [parsed];
                     }
                     catch {
-                        // Fall back to comma-splitting below.
+                        rawList = trimmed.includes(",")
+                            ? trimmed
+                                .split(",")
+                                .map((part) => part.trim())
+                                .filter(Boolean)
+                            : [trimmed];
                     }
                 }
-                return trimmed.includes(',')
-                    ? trimmed.split(',').map(part => part.trim()).filter(Boolean)
-                    : [trimmed];
+                else {
+                    rawList = trimmed.includes(",")
+                        ? trimmed
+                            .split(",")
+                            .map((part) => part.trim())
+                            .filter(Boolean)
+                        : [trimmed];
+                }
             }
-            return [value];
+            else {
+                rawList = [value];
+            }
+            return rawList.map((item) => this.coerceScalarValue(item, expectedType, schema, field));
         }
-        if (typeof value === 'string') {
+        if (typeof value === "string") {
             const trimmed = value.trim();
             if (!trimmed) {
                 return value;
             }
             try {
-                if ((trimmed.startsWith('[') && trimmed.endsWith(']')) || (trimmed.startsWith('{') && trimmed.endsWith('}'))) {
+                if ((trimmed.startsWith("[") && trimmed.endsWith("]")) ||
+                    (trimmed.startsWith("{") && trimmed.endsWith("}"))) {
                     const parsed = JSON.parse(trimmed);
                     return parsed;
                 }
             }
             catch {
-                // Keep the original string when the value is not valid JSON.
+                // Keep original string if not valid JSON
+            }
+        }
+        return this.coerceScalarValue(value, expectedType, schema, field);
+    }
+    /**
+     * Recursively strips blocked fields from returned database records or objects.
+     */
+    static filterBlockedData(data, config, currentPath = "", rootTable) {
+        if (!config?.blockList?.length && !config?.allowList?.length) {
+            return data;
+        }
+        if (data === null || data === undefined) {
+            return data;
+        }
+        if (Array.isArray(data)) {
+            return data.map((item) => this.filterBlockedData(item, config, currentPath, rootTable));
+        }
+        if (typeof data === "object" && !(data instanceof Date)) {
+            const sanitized = {};
+            for (const [key, val] of Object.entries(data)) {
+                const subPath = currentPath ? `${currentPath}.${key}` : key;
+                const tablePrefixedPath = rootTable && !subPath.startsWith(`${rootTable}.`)
+                    ? `${rootTable}.${subPath}`
+                    : subPath;
+                const parts = subPath.split(".");
+                const fieldLeaf = parts[parts.length - 1];
+                // Check blockList
+                let isBlocked = false;
+                if (config.blockList?.length) {
+                    isBlocked = config.blockList.some((rule) => {
+                        const trimmedRule = rule.trim();
+                        return (this.matchesSecurityRule(subPath, trimmedRule) ||
+                            this.matchesSecurityRule(fieldLeaf, trimmedRule));
+                    });
+                }
+                // Check allowList (if supplied)
+                let isAllowed = true;
+                if (config.allowList?.length) {
+                    isAllowed = config.allowList.some((rule) => {
+                        const trimmedRule = rule.trim();
+                        return (this.matchesSecurityRule(subPath, trimmedRule) ||
+                            this.matchesSecurityRule(tablePrefixedPath, trimmedRule) ||
+                            this.matchesSecurityRule(fieldLeaf, trimmedRule));
+                    });
+                }
+                if (isBlocked || !isAllowed) {
+                    continue;
+                }
+                sanitized[key] = this.filterBlockedData(val, config, subPath, rootTable);
+            }
+            return sanitized;
+        }
+        return data;
+    }
+    static sanitizeTree(tree, currentPath, config, rootTable) {
+        const sanitized = {};
+        for (const [key, val] of Object.entries(tree)) {
+            const isPrismaKeyword = key === "include" ||
+                key === "select" ||
+                key === "where" ||
+                key === "orderBy" ||
+                key === "take" ||
+                key === "skip" ||
+                key === "some" ||
+                key === "every" ||
+                key === "none" ||
+                key === "is" ||
+                key === "isNot";
+            const subPath = isPrismaKeyword
+                ? currentPath
+                : currentPath
+                    ? `${currentPath}.${key}`
+                    : key;
+            if (!isPrismaKeyword) {
+                this.validatePath(subPath, config, "field", rootTable);
+            }
+            if (val === true || val === false) {
+                sanitized[key] = val;
             }
+            else if (val && typeof val === "object") {
+                if (Array.isArray(val)) {
+                    sanitized[key] = val.map((item) => item && typeof item === "object"
+                        ? this.sanitizeTree(item, subPath, config, rootTable)
+                        : item);
+                }
+                else {
+                    sanitized[key] = this.sanitizeTree(val, subPath, config, rootTable);
+                }
+            }
+            else {
+                sanitized[key] = val;
+            }
+        }
+        return sanitized;
+    }
+    static sanitizeOrderBy(orderBy, config, rootTable) {
+        if (!orderBy)
+            return undefined;
+        if (Array.isArray(orderBy)) {
+            return orderBy.map((item) => this.sanitizeOrderBy(item, config, rootTable));
+        }
+        if (typeof orderBy === "object") {
+            return this.sanitizeTree(orderBy, "", config, rootTable);
         }
-        return value;
+        return orderBy;
+    }
+    static findModel(modelName, schema) {
+        if (!schema?.models?.length)
+            return undefined;
+        const lower = modelName.trim().toLowerCase();
+        return schema.models.find((m) => m.name.toLowerCase() === lower);
+    }
+    /**
+     * Expands dot-notation field paths (e.g. "user.profile.age" or "user.loginAttempts.success")
+     * into nested Prisma filter objects, automatically wrapping list relations with `some`.
+     */
+    static buildNestedCondition(fieldParts, operator, value, currentModelName, schema) {
+        if (fieldParts.length === 1) {
+            return {
+                [fieldParts[0]]: {
+                    [operator]: value,
+                },
+            };
+        }
+        const [head, ...tail] = fieldParts;
+        const model = currentModelName
+            ? this.findModel(currentModelName, schema)
+            : undefined;
+        const fieldDef = model?.fields.find((f) => f.name.toLowerCase() === head.toLowerCase());
+        const nextModelName = fieldDef?.type;
+        const nestedInner = this.buildNestedCondition(tail, operator, value, nextModelName, schema);
+        // If the relation is a 1-to-many list (e.g. loginAttempts: LoginAttempt[]), Prisma requires `{ some: ... }`
+        if (fieldDef?.isList && fieldDef?.relation) {
+            return {
+                [head]: {
+                    some: nestedInner,
+                },
+            };
+        }
+        return {
+            [head]: nestedInner,
+        };
+    }
+    /**
+     * Resolves a field's type across both direct columns and multi-level dot-notation paths.
+     */
+    static lookupFieldType(targetTable, fieldPath, schema) {
+        if (!schema?.models?.length)
+            return undefined;
+        const parts = fieldPath.trim().split(".");
+        let currentModel = this.findModel(targetTable, schema);
+        for (let i = 0; i < parts.length; i++) {
+            if (!currentModel)
+                return undefined;
+            const part = parts[i].toLowerCase();
+            const field = currentModel.fields.find((f) => f.name.toLowerCase() === part);
+            if (!field)
+                return undefined;
+            if (i === parts.length - 1) {
+                return field.type;
+            }
+            currentModel = this.findModel(field.type, schema);
+        }
+        return undefined;
     }
     static parseDynamicQuery(rawAiOutput, config) {
         let parsedInput = rawAiOutput;
-        if (typeof rawAiOutput === 'string') {
+        if (typeof rawAiOutput === "string") {
             try {
                 parsedInput = JSON.parse(rawAiOutput);
             }
-            catch (e) {
+            catch {
                 throw new Error("AI output was not valid JSON.");
             }
         }
         const validatedData = schema_1.AIQueryResponseSchema.parse(parsedInput);
-        const targetTable = typeof validatedData.targetTable === 'string' ? validatedData.targetTable.trim() : '';
+        const targetTable = typeof validatedData.targetTable === "string"
+            ? validatedData.targetTable.trim()
+            : "";
         if (!targetTable) {
-            throw new Error('Security Exception: AI output did not include a valid targetTable.');
-        }
-        if (config?.blockList && config.blockList.some(rule => this.matchesSecurityRule(targetTable, rule))) {
-            throw new Error(`Security Exception: AI attempted to query a blocked table -> ${targetTable}`);
-        }
-        if (config?.allowList && !config.allowList.some(rule => this.matchesSecurityRule(targetTable, rule))) {
-            throw new Error(`Security Exception: AI attempted to query a non-allowlisted table -> ${targetTable}`);
+            throw new Error("Security Exception: AI output did not include a valid targetTable.");
         }
-        const conditions = validatedData.filters.map(filter => {
+        // Validate root table
+        this.validatePath(targetTable, config, "table");
+        // Build conditions (expanding dot-notation paths into nested Prisma relational filters)
+        const conditions = validatedData.filters.map((filter) => {
             const normalizedField = filter.field.trim();
-            if (config?.blockList && config.blockList.some(rule => this.matchesSecurityRule(normalizedField, rule))) {
-                throw new Error(`Security Exception: AI attempted to query a blocked table or field -> ${normalizedField}`);
-            }
-            if (config?.allowList && !config.allowList.some(rule => this.matchesSecurityRule(normalizedField, rule))) {
-                throw new Error(`Security Exception: AI attempted to query a non-allowlisted field -> ${normalizedField}`);
-            }
-            const normalizedValue = this.normalizeFilterValue(filter);
-            return {
-                [normalizedField]: {
-                    [filter.operator]: normalizedValue
-                }
-            };
+            // Validate full field path
+            this.validatePath(normalizedField, config, "field", targetTable);
+            const expectedType = this.lookupFieldType(targetTable, normalizedField, config?.schemaContext);
+            const normalizedValue = this.normalizeFilterValue(filter, expectedType, config?.schemaContext);
+            const fieldParts = normalizedField
+                .split(".")
+                .map((p) => p.trim())
+                .filter(Boolean);
+            return this.buildNestedCondition(fieldParts, filter.operator, normalizedValue, targetTable, config?.schemaContext);
         });
-        const whereClause = conditions.length === 0 ? {} : { [validatedData.logicalOperator]: conditions };
-        return {
+        const whereClause = conditions.length === 0
+            ? {}
+            : { [validatedData.logicalOperator]: conditions };
+        const result = {
             targetTable,
-            where: whereClause
+            where: whereClause,
         };
+        // Sanitize and attach multi-level include or select (mutually exclusive in Prisma at root)
+        if (validatedData.select &&
+            typeof validatedData.select === "object" &&
+            Object.keys(validatedData.select).length > 0) {
+            result.select = this.sanitizeTree(validatedData.select, "", config, targetTable);
+        }
+        else if (validatedData.include &&
+            typeof validatedData.include === "object" &&
+            Object.keys(validatedData.include).length > 0) {
+            result.include = this.sanitizeTree(validatedData.include, "", config, targetTable);
+        }
+        // Sanitize and attach ordering
+        if (validatedData.orderBy) {
+            result.orderBy = this.sanitizeOrderBy(validatedData.orderBy, config, targetTable);
+        }
+        // Attach pagination
+        if (typeof validatedData.take === "number") {
+            result.take = validatedData.take;
+        }
+        if (typeof validatedData.skip === "number") {
+            result.skip = validatedData.skip;
+        }
+        return result;
     }
 }
 exports.PrismaAIEngine = PrismaAIEngine;

package/dist/index.d.ts

@@ -1,3 +1,4 @@
-export { PrismaAIEngine, type SecurityConfig } from './engine';
-export { PrismaGeminiAgent, type AgentConfig } from './agent';
-export { AIQueryResponseSchema, PrismaOperatorSchema, type AIQueryResponse } from './schema';
+export { PrismaAIEngine, type SecurityConfig, type ParsedDynamicQuery } from './engine';
+export { PrismaGeminiAgent, type AgentConfig, type NaturalLanguageResult } from './agent';
+export { AIQueryResponseSchema, PrismaOperatorSchema, QueryConditionSchema, type AIQueryResponse, type QueryCondition } from './schema';
+export { extractPrismaSchema, parsePrismaSchemaText, formatSchemaForAIContext, findPrismaSchemaPath, type ExtractedSchema, type ExtractedModel, type ExtractedField, type ExtractedEnum } from './introspect';

package/dist/index.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.PrismaOperatorSchema = exports.AIQueryResponseSchema = exports.PrismaGeminiAgent = exports.PrismaAIEngine = void 0;
+exports.findPrismaSchemaPath = exports.formatSchemaForAIContext = exports.parsePrismaSchemaText = exports.extractPrismaSchema = exports.QueryConditionSchema = exports.PrismaOperatorSchema = exports.AIQueryResponseSchema = exports.PrismaGeminiAgent = exports.PrismaAIEngine = void 0;
 var engine_1 = require("./engine");
 Object.defineProperty(exports, "PrismaAIEngine", { enumerable: true, get: function () { return engine_1.PrismaAIEngine; } });
 var agent_1 = require("./agent");
@@ -8,3 +8,9 @@ Object.defineProperty(exports, "PrismaGeminiAgent", { enumerable: true, get: fun
 var schema_1 = require("./schema");
 Object.defineProperty(exports, "AIQueryResponseSchema", { enumerable: true, get: function () { return schema_1.AIQueryResponseSchema; } });
 Object.defineProperty(exports, "PrismaOperatorSchema", { enumerable: true, get: function () { return schema_1.PrismaOperatorSchema; } });
+Object.defineProperty(exports, "QueryConditionSchema", { enumerable: true, get: function () { return schema_1.QueryConditionSchema; } });
+var introspect_1 = require("./introspect");
+Object.defineProperty(exports, "extractPrismaSchema", { enumerable: true, get: function () { return introspect_1.extractPrismaSchema; } });
+Object.defineProperty(exports, "parsePrismaSchemaText", { enumerable: true, get: function () { return introspect_1.parsePrismaSchemaText; } });
+Object.defineProperty(exports, "formatSchemaForAIContext", { enumerable: true, get: function () { return introspect_1.formatSchemaForAIContext; } });
+Object.defineProperty(exports, "findPrismaSchemaPath", { enumerable: true, get: function () { return introspect_1.findPrismaSchemaPath; } });

package/dist/introspect.d.ts

@@ -0,0 +1,42 @@
+export interface ExtractedField {
+    name: string;
+    type: string;
+    isList: boolean;
+    isRequired: boolean;
+    relation?: boolean;
+    relationFromFields?: string[];
+    relationToFields?: string[];
+}
+export interface ExtractedModel {
+    name: string;
+    fields: ExtractedField[];
+}
+export interface ExtractedEnum {
+    name: string;
+    values: string[];
+}
+export interface ExtractedSchema {
+    models: ExtractedModel[];
+    enums: ExtractedEnum[];
+}
+/**
+ * Searches default standard locations for schema.prisma if no explicit path is given.
+ */
+export declare function findPrismaSchemaPath(customPath?: string): string | null;
+/**
+ * Parses raw schema.prisma contents into structured models, relations, foreign keys, and enums,
+ * filtering out datasource URLs, generators, comments, and private credentials.
+ */
+export declare function parsePrismaSchemaText(schemaContent: string): ExtractedSchema;
+/**
+ * Extracts schema information from a Prisma client instance, DMMF, _runtimeDataModel, or schema file.
+ */
+export declare function extractPrismaSchema(input?: string | {
+    _dmmf?: any;
+    _runtimeDataModel?: any;
+    dmmf?: any;
+} | any): ExtractedSchema;
+/**
+ * Formats extracted schema models, foreign-key relationships, and enums into an AI-digestible context string.
+ */
+export declare function formatSchemaForAIContext(schema: ExtractedSchema): string;