sveltekit-admin 0.5.3 → 0.8.1

package/dist/server/query/listQuery.js

@@ -12,6 +12,7 @@
  * string) becomes the Prisma operator key.
  */
 import { isSensitiveFieldName } from '../introspection/parser.js';
+import { normalizeScope } from '../adapters/filter.js';
 /** Max length accepted for the free-text search term. Longer input is truncated. */
 const MAX_SEARCH_LENGTH = 200;
 /**
@@ -351,92 +352,69 @@ export function parseListQuery(searchParams, model, enums, searchFields, filtera
 }
 function clauseOf(filter) {
     if (filter.op === 'gte' && filter.value && typeof filter.value === 'object' && 'gte' in filter.value) {
-        // Date shortcut carrying both bounds (see parseOneFilter's DateTime branch).
+        // Date shortcut carrying both bounds (see parseOneFilter's DateTime branch) —
+        // becomes two leaf clauses, re-merged by the Prisma filterCompiler.
         const range = filter.value;
-        return { [filter.field]: { gte: range.gte, lt: range.lt } };
+        return [
+            { op: 'gte', field: filter.field, value: range.gte },
+            { op: 'lt', field: filter.field, value: range.lt }
+        ];
     }
     if (filter.op === 'isnull') {
-        return { [filter.field]: filter.value ? { equals: null } : { not: null } };
+        return [{ op: filter.value ? 'isNull' : 'isNotNull', field: filter.field }];
     }
     if (filter.op === 'equals') {
-        return { [filter.field]: filter.value };
+        return [{ op: 'eq', field: filter.field, value: filter.value }];
     }
-    return { [filter.field]: { [filter.op]: filter.value } };
+    return [{ op: filter.op, field: filter.field, value: filter.value }];
 }
 /**
- * Compose the final Prisma `where`: `AND: [scope, ...filters, {OR: search}]`.
- * NEVER a spread — a spread of `{...scope, ...filterWhere}` lets a filter
- * on the same field as the developer's scoping silently overwrite it
- * (docs/design §0.c, the exact IDOR the previous `?filter=` had). Two
- * clauses on the same field inside `AND` intersect; they never merge.
- *
- * Returns `undefined` when nothing is active, so the query shape sent to
- * Prisma is byte-for-byte identical to today's unfiltered call — no
- * regression on existing snapshots/assertions.
+ * Compose the final generic `Filter`: `and: [scope, ...filters, {or: search}]`.
+ * NEVER a spread. Flat `{ tenantId: 1 }` scopes become `eq` leaves via
+ * `normalizeScope`; nested Prisma where objects stay opaque for the Prisma
+ * compiler. Drizzle's compiler throws on those opaques.
  */
 export function buildWhere(query, scope, caseInsensitiveSearch, model) {
     const and = [];
-    if (scope)
-        and.push(scope);
+    const normalized = normalizeScope(scope);
+    if (normalized)
+        and.push(normalized);
     for (const f of query.filters)
-        and.push(clauseOf(f));
+        and.push(...clauseOf(f));
     if (query.q && query.searchFields.length > 0) {
         const or = [];
         for (const fieldName of query.searchFields) {
             const field = model.fields.find((f) => f.name === fieldName);
-            const clause = searchClauseFor(field, query.q, caseInsensitiveSearch);
+            const clause = searchClauseFor(field, fieldName, query.q);
             if (clause)
-                or.push({ [fieldName]: clause });
+                or.push(clause);
         }
-        // Never emit `{OR: []}` — in Prisma that matches nothing, which would
-        // silently turn "no searchable field" (or "every clause omitted", §2.4)
-        // into "empty result". A no-op search must add nothing to the where.
         if (or.length > 0)
-            and.push({ OR: or });
+            and.push({ op: 'or', clauses: or });
     }
     if (and.length === 0)
         return undefined;
     if (and.length === 1)
         return and[0];
-    return { AND: and };
+    return { op: 'and', clauses: and };
 }
 /**
- * The per-field-type clause for a `searchFields` entry (§2.4):
- * - String @id -> `equals` (a `contains` on a cuid/uuid can't use the
- *   index and never makes semantic sense; §2.1 talks ONLY about the id
- *   here — an earlier version of this function over-generalized to
- *   `@id || @unique`, which silently broke fragment search on the most
- *   common real-world case: `email`/`slug` fields are `@unique` in
- *   nearly every Prisma schema and are exactly what §2.3's "a title, an
- *   email" example means by free-text search. `@unique` alone is NOT a
- *   reason to switch to `equals` — only `@id` is).
- * - other String (including @unique) -> `contains` (+ `mode:
- *   'insensitive'` when the provider supports it).
- * - Int/BigInt/Float/Decimal -> `equals` if `q` coerces to that type,
- *   otherwise the clause is OMITTED — never `contains` on a numeric
- *   column, which Prisma rejects with a hard error (`Unknown argument
- *   contains`), turning any legitimate `?q=` into a 500 (§10's known
- *   trap, discovered via review — the original implementation searched
- *   this exactly wrong).
- * - anything else (enum, Boolean, DateTime, relation, Json/Bytes):
- *   omitted. `resolveSearchFields`'s auto heuristic never proposes these,
- *   but explicit `searchFields` config isn't type-checked against §2.4 at
- *   boot (only against `isFilterableFieldType`), so this is reached in
- *   practice for a misconfigured field — degrading to "omitted" here
- *   keeps the guarantee that a legitimate URL never 500s, without adding
- *   a boot-time validation pass this design doc doesn't ask for.
+ * The per-field-type clause for a `searchFields` entry (§2.4) — same rules as
+ * before (String @id -> eq, other String -> contains, numeric -> eq if
+ * coercible else omitted, anything else omitted). `caseInsensitiveSearch` no
+ * longer lives here: the generic `Filter` doesn't carry a case-sensitivity
+ * flag, `filterCompiler.ts` decides whether to add `mode: 'insensitive'` from
+ * the same boolean at the handler.ts call site instead.
  */
-function searchClauseFor(field, q, caseInsensitiveSearch) {
+function searchClauseFor(field, fieldName, q) {
     if (!field)
         return undefined;
     if (field.type === 'String') {
-        if (field.isId)
-            return { equals: q };
-        return caseInsensitiveSearch ? { contains: q, mode: 'insensitive' } : { contains: q };
+        return field.isId ? { op: 'eq', field: fieldName, value: q } : { op: 'contains', field: fieldName, value: q };
     }
     if (['Int', 'BigInt', 'Float', 'Decimal'].includes(field.type)) {
         const coerced = coerceValue(field, 'equals', q);
-        return coerced === undefined ? undefined : { equals: coerced };
+        return coerced === undefined ? undefined : { op: 'eq', field: fieldName, value: coerced };
     }
     return undefined;
 }

package/dist/server/relationLoaders.d.ts

@@ -0,0 +1,42 @@
+/**
+ * Relation option loaders shared by the create/edit Form and the list-view
+ * FK filter sidebar. Split out of `handler.ts` — pure orchestration over
+ * `AdminRuntime` (schema/relationGraph/adapter already resolved at boot),
+ * no boot logic lives here.
+ */
+import type { PrismaModel } from './introspection/parser.js';
+import type { RelationMeta, FkFilterMeta } from './views/types.js';
+import { type AdminRuntime } from './runtime.js';
+import type { Filter } from './adapters/types.js';
+export declare function combinedScope(...scopes: Array<Filter | Record<string, unknown> | undefined>): Filter | undefined;
+export declare function filterSelectedIds(runtime: AdminRuntime, targetModel: PrismaModel, ids: Array<string | number> | undefined, ctx: {
+    locals?: any;
+}, relationScope?: Filter | Record<string, unknown>): Promise<Array<string | number> | undefined>;
+/**
+ * Charge les options pour toutes les arêtes to-one-owning et m2m
+ * d'un modèle. Une requête COUNT par relation avant le findMany : évite de
+ * charger 10k lignes pour découvrir qu'il y en a 10k.
+ */
+export declare function loadRelationOptions(runtime: AdminRuntime, model: PrismaModel, ctx: {
+    locals?: any;
+}, currentId?: string): Promise<Map<string, RelationMeta>>;
+/**
+ * Options d'un filtre FK : charge et scope les valeurs possibles pour la
+ * sidebar, ET résout le label du chip actif. Doctrine IDOR (docs/design
+ * §6.3) : les options ET le label du chip passent par le `where` de
+ * scoping de la relation — un chip forgé avec un ID hors scope affiche
+ * l'ID brut, jamais le label (sinon c'est un oracle sur le nom d'un
+ * enregistrement d'un autre tenant).
+ */
+export declare function resolveFkFilterOptions(runtime: AdminRuntime, model: PrismaModel, fkFieldName: string, label: string, ctx: {
+    locals?: any;
+}, activeRawValue: string | undefined): Promise<FkFilterMeta>;
+/**
+ * Compte, pour chaque relation inverse (1-N, 1-1) d'un modèle, le nombre
+ * d'enregistrements liés côté cible. Résilient : une cible dont le client
+ * échoue (mock partiel, modèle absent) retombe sur 0 plutôt que de casser
+ * le rendu du formulaire.
+ */
+export declare function loadRelatedCounts(runtime: AdminRuntime, model: PrismaModel, currentId: string, ctx: {
+    locals?: any;
+}): Promise<Map<string, number>>;

package/dist/server/relationLoaders.js

@@ -0,0 +1,188 @@
+/**
+ * Relation option loaders shared by the create/edit Form and the list-view
+ * FK filter sidebar. Split out of `handler.ts` — pure orchestration over
+ * `AdminRuntime` (schema/relationGraph/adapter already resolved at boot),
+ * no boot logic lives here.
+ */
+import { primaryKeyOf, coerceId } from './data.js';
+import { findFkEdge } from './query/filterDetection.js';
+import { scopeFrom, modelScopeFrom } from './runtime.js';
+import { normalizeScope } from './adapters/filter.js';
+export function combinedScope(...scopes) {
+    const clauses = scopes.map((scope) => normalizeScope(scope)).filter((scope) => scope !== undefined);
+    if (clauses.length === 0)
+        return undefined;
+    if (clauses.length === 1)
+        return clauses[0];
+    return { op: 'and', clauses };
+}
+export async function filterSelectedIds(runtime, targetModel, ids, ctx, relationScope) {
+    if (!ids)
+        return undefined;
+    const scope = combinedScope(modelScopeFrom(runtime, targetModel, ctx), relationScope);
+    if (!scope || ids.length === 0)
+        return ids;
+    const rows = await runtime.adapter.data.findMany(targetModel, {
+        filter: combinedScope(scope, { op: 'in', field: primaryKeyOf(targetModel), value: ids })
+    });
+    const allowed = new Set(rows.map((row) => String(row[primaryKeyOf(targetModel)])));
+    return ids.filter((id) => allowed.has(String(id)));
+}
+/**
+ * Charge les options pour toutes les arêtes to-one-owning et m2m
+ * d'un modèle. Une requête COUNT par relation avant le findMany : évite de
+ * charger 10k lignes pour découvrir qu'il y en a 10k.
+ */
+export async function loadRelationOptions(runtime, model, ctx, currentId) {
+    const modelsConfig = runtime.config.models ?? {};
+    const edges = [...runtime.relationGraph.edges.values()].filter((edge) => {
+        if (edge.model !== model.name)
+            return false;
+        if (edge.kind !== 'to-one-owning' && edge.kind !== 'm2m')
+            return false;
+        if (edge.unsupported)
+            return false;
+        const relConfig = modelsConfig[model.name]?.relations?.[edge.field];
+        return relConfig?.widget !== 'hidden';
+    });
+    // Une relation ne dépend pas de l'autre : chargées en parallèle plutôt
+    // qu'en série (un modèle avec N relations ne doit pas payer N
+    // aller-retours DB empilés pour afficher un seul formulaire).
+    const entries = await Promise.all(edges.map(async (edge) => {
+        const key = `${edge.model}.${edge.field}`;
+        const relConfig = modelsConfig[model.name]?.relations?.[edge.field];
+        const targetModel = runtime.schema.models.find((m) => m.name === edge.target);
+        const filter = combinedScope(modelScopeFrom(runtime, targetModel, ctx), scopeFrom(relConfig, ctx));
+        try {
+            const total = await runtime.adapter.data.countRecords(targetModel, filter);
+            if (total > runtime.selectThreshold || relConfig?.widget === 'raw-id') {
+                const selectedIds = edge.kind === 'm2m' && currentId
+                    ? await filterSelectedIds(runtime, targetModel, await runtime.adapter.data.getM2mSelectedIds(model, edge, targetModel, currentId), ctx, scopeFrom(relConfig, ctx))
+                    : undefined;
+                return [key, { tooMany: true, options: [], selectedIds }];
+            }
+            const rows = await runtime.adapter.data.findMany(targetModel, { filter, orderBy: relConfig?.orderBy });
+            const options = rows.map((row) => ({
+                id: row[primaryKeyOf(targetModel)],
+                label: runtime.resolveLabel(targetModel, row, relConfig?.labelTemplate)
+            }));
+            const selectedIds = edge.kind === 'm2m' && currentId
+                ? await filterSelectedIds(runtime, targetModel, await runtime.adapter.data.getM2mSelectedIds(model, edge, targetModel, currentId), ctx, scopeFrom(relConfig, ctx))
+                : undefined;
+            return [key, { tooMany: false, options, selectedIds }];
+        }
+        catch {
+            // Cible absente de la base ou client incomplet : repli raw-id pour
+            // garder le champ éditable plutôt que de faire échouer tout le form.
+            return [key, { tooMany: true, options: [] }];
+        }
+    }));
+    return new Map(entries);
+}
+/**
+ * Options d'un filtre FK : charge et scope les valeurs possibles pour la
+ * sidebar, ET résout le label du chip actif. Doctrine IDOR (docs/design
+ * §6.3) : les options ET le label du chip passent par le `where` de
+ * scoping de la relation — un chip forgé avec un ID hors scope affiche
+ * l'ID brut, jamais le label (sinon c'est un oracle sur le nom d'un
+ * enregistrement d'un autre tenant).
+ */
+export async function resolveFkFilterOptions(runtime, model, fkFieldName, label, ctx, activeRawValue) {
+    // Appelé uniquement pour un filtre `kind: 'fk'` retourné par
+    // resolveListFilters avec CE MÊME graphe : graphe et arête existent donc
+    // par construction. Garder des gardes here masquerait une incohérence
+    // interne et ajouterait du code mort (coverage artificielle).
+    const edge = findFkEdge(runtime.relationGraph, model.name, fkFieldName);
+    // Non-null par construction : un filtre `kind: 'fk'` ne peut exister que
+    // via `models[model.name].listFilter` explicite (CLAUDE.md — les filtres
+    // FK ne sont jamais auto-détectés) ; `runtime.config.models` est donc
+    // déjà renseigné pour ce modèle avant que cette fonction ne soit appelée.
+    const modelsConfig = runtime.config.models;
+    const targetModel = runtime.schema.models.find((m) => m.name === edge.target);
+    // Non-null par construction : `edge` vient du graphe dérivé du même
+    // schéma parsé avec succès — une arête ne peut pas cibler un modèle qui
+    // n'existe pas dans `schema.models`.
+    const relConfig = modelsConfig[model.name]?.relations?.[edge.field];
+    const scope = combinedScope(modelScopeFrom(runtime, targetModel, ctx), scopeFrom(relConfig, ctx));
+    // Options de la sidebar (comptées puis chargées si sous le seuil) et
+    // label du chip actif (§6.3.b) sont deux requêtes indépendantes — l'une
+    // ne dépend pas du résultat de l'autre — donc en parallèle plutôt qu'en
+    // série.
+    const loadOptions = async () => {
+        try {
+            const total = await runtime.adapter.data.countRecords(targetModel, scope);
+            if (total > runtime.selectThreshold) {
+                return { options: [], tooMany: true };
+            }
+            const rows = await runtime.adapter.data.findMany(targetModel, { filter: scope, orderBy: relConfig?.orderBy });
+            const options = rows.map((row) => ({
+                id: row[primaryKeyOf(targetModel)],
+                label: runtime.resolveLabel(targetModel, row, relConfig?.labelTemplate)
+            }));
+            return { options, tooMany: false };
+        }
+        catch {
+            return { options: [], tooMany: true };
+        }
+    };
+    // Un ID hors scope retourne null ici → le composant affiche l'ID brut,
+    // jamais le label (sinon c'est un oracle sur le nom d'un enregistrement
+    // d'un autre tenant).
+    const loadActiveLabel = async () => {
+        if (activeRawValue === undefined)
+            return undefined;
+        const activeId = coerceId(activeRawValue, targetModel);
+        try {
+            const idFilter = { op: 'eq', field: primaryKeyOf(targetModel), value: activeId };
+            const filter = scope ? { op: 'and', clauses: [idFilter, scope] } : idFilter;
+            const row = await runtime.adapter.data.findFirst(targetModel, filter);
+            return row ? runtime.resolveLabel(targetModel, row, relConfig?.labelTemplate) : undefined;
+        }
+        catch {
+            return undefined;
+        }
+    };
+    const [{ options, tooMany }, activeLabel] = await Promise.all([loadOptions(), loadActiveLabel()]);
+    return {
+        field: fkFieldName,
+        label,
+        relationField: edge.field,
+        targetModel: edge.target,
+        options,
+        mode: tooMany ? 'raw-id' : options.length <= runtime.filterLinkThreshold ? 'links' : 'select',
+        tooMany,
+        activeLabel,
+        // Une cible exclue/masquée n'a pas de page admin : le chip reste du
+        // texte, jamais un lien mort (docs/design §6.4).
+        activeHref: activeLabel && runtime.findModel(edge.target)
+            ? `${runtime.basePath}/${edge.target.toLowerCase()}/${encodeURIComponent(activeRawValue)}`
+            : undefined
+    };
+}
+/**
+ * Compte, pour chaque relation inverse (1-N, 1-1) d'un modèle, le nombre
+ * d'enregistrements liés côté cible. Résilient : une cible dont le client
+ * échoue (mock partiel, modèle absent) retombe sur 0 plutôt que de casser
+ * le rendu du formulaire.
+ */
+export async function loadRelatedCounts(runtime, model, currentId, ctx) {
+    const edges = [...runtime.relationGraph.edges.values()].filter((edge) => edge.model === model.name && (edge.kind === 'to-many-inverse' || edge.kind === 'to-one-inverse'));
+    // Un count par relation inverse, indépendants entre eux : en parallèle
+    // plutôt qu'empilés un par un (même raisonnement que loadRelationOptions).
+    const entries = await Promise.all(edges.map(async (edge) => {
+        const owning = [...runtime.relationGraph.edges.values()].find((o) => o.model === edge.target && o.kind === 'to-one-owning' && o.relationName === edge.relationName);
+        if (!owning || owning.unsupported)
+            return undefined;
+        const scalarName = owning.scalarFields[0];
+        const key = `${edge.model}.${edge.field}`;
+        const targetModel = runtime.schema.models.find((m) => m.name === edge.target);
+        try {
+            const count = await runtime.adapter.data.countRecords(targetModel, combinedScope(modelScopeFrom(runtime, targetModel, ctx), { op: 'eq', field: scalarName, value: coerceId(currentId, model) }));
+            return [key, count];
+        }
+        catch {
+            return [key, 0];
+        }
+    }));
+    return new Map(entries.filter((e) => e !== undefined));
+}

package/dist/server/router.d.ts

@@ -3,4 +3,14 @@ export interface ParsedRoute {
     model?: string;
     id?: string;
 }
+export interface RouteEntry {
+    pattern: string[];
+    view: string;
+}
+export declare const BUILTIN_ROUTES: RouteEntry[];
+export declare function matchRoute(pathname: string, basePath: string, routes: RouteEntry[]): {
+    view: string;
+    model?: string;
+    id?: string;
+};
 export declare function parseRoute(pathname: string, basePath: string): ParsedRoute;

package/dist/server/router.js

@@ -1,27 +1,50 @@
-export function parseRoute(pathname, basePath) {
+export const BUILTIN_ROUTES = [
+    { pattern: [], view: 'dashboard' },
+    { pattern: ['_search'], view: 'search' },
+    { pattern: ['_logout'], view: 'logout' },
+    { pattern: [':model', 'new'], view: 'create' },
+    { pattern: [':model', ':id'], view: 'edit' },
+    { pattern: [':model'], view: 'list' }
+];
+function relativeSegments(pathname, basePath) {
     // Le `replace` n'est PAS redondant avec le `filter(Boolean)` plus bas : il est ce
     // qui fait que `/admin/` et `/admin///` donnent un `path` vide, donc le dashboard.
     // Sans lui, `path` vaudrait '/' — truthy — et le chemin tomberait sur `notFound`.
     const path = pathname.slice(basePath.length).replace(/^\/+|\/+$/g, '');
-    if (!path) {
-        return { view: 'dashboard' };
-    }
-    const segments = path.split('/').filter(Boolean);
-    if (segments.length === 1) {
-        if (segments[0] === '_search') {
-            return { view: 'search' };
-        }
-        if (segments[0] === '_logout') {
-            return { view: 'logout' };
-        }
-        return { view: 'list', model: segments[0] };
-    }
-    if (segments.length === 2) {
-        if (segments[1] === 'new') {
-            return { view: 'create', model: segments[0] };
+    if (!path)
+        return [];
+    return path.split('/').filter(Boolean);
+}
+export function matchRoute(pathname, basePath, routes) {
+    const segments = relativeSegments(pathname, basePath);
+    for (const route of routes) {
+        if (route.pattern.length !== segments.length)
+            continue;
+        const captured = {};
+        let ok = true;
+        for (let i = 0; i < route.pattern.length; i++) {
+            const token = route.pattern[i];
+            const seg = segments[i];
+            if (token === ':model') {
+                captured.model = seg;
+            }
+            else if (token === ':id') {
+                captured.id = seg;
+            }
+            else if (token !== seg) {
+                ok = false;
+                break;
+            }
         }
-        return { view: 'edit', model: segments[0], id: segments[1] };
+        if (ok)
+            return { view: route.view, ...captured };
     }
-    // 3 segments ou plus : aucune vue ne correspond.
     return { view: 'notFound' };
 }
+// Builtins-only helper — NOT the handler's dispatch path. `handler.ts` calls
+// `matchRoute` directly with `[...pluginRoutes, ...BUILTIN_ROUTES]` so plugin
+// patterns are considered first; this function stays around for tests and
+// any caller that only cares about the builtin route table.
+export function parseRoute(pathname, basePath) {
+    return matchRoute(pathname, basePath, BUILTIN_ROUTES);
+}

package/dist/server/runtime.d.ts

@@ -0,0 +1,46 @@
+import type { Schema, Model } from './types/schema.js';
+import { type RelationGraph } from './introspection/relations.js';
+import type { ViewModel } from './views/types.js';
+import type { DataAdapter, SchemaIntrospector, Filter } from './adapters/types.js';
+import type { AdminHandlerConfig } from './handler.js';
+export declare function scopeFrom(relConfig: {
+    where?: (ctx: any) => any;
+} | undefined, ctx: {
+    locals?: any;
+}): any;
+export declare function listScopeFrom(runtime: AdminRuntime, model: Model, ctx: {
+    locals?: any;
+}): Record<string, unknown> | undefined;
+export declare function modelScopeFrom(runtime: AdminRuntime, model: Model, ctx: {
+    locals?: any;
+}): Filter | undefined;
+/** Extract equality predicates so create can force tenant-owned columns. */
+export declare function modelScopeValues(runtime: AdminRuntime, model: Model, ctx: {
+    locals?: any;
+}): Record<string, unknown>;
+export interface AdminRuntime {
+    adapter: {
+        introspector: SchemaIntrospector;
+        data: DataAdapter;
+    };
+    schema: Schema | null;
+    relationGraph: RelationGraph | null;
+    models: Model[];
+    modelList: Array<{
+        name: string;
+        label: string;
+    }>;
+    config: AdminHandlerConfig;
+    basePath: string;
+    perPage: number;
+    selectThreshold: number;
+    filterLinkThreshold: number;
+    labelFieldCandidates: string[];
+    findModel(name?: string): Model | undefined;
+    labelOf(model: Model): string;
+    hiddenFieldsOf(model: Model): Set<string>;
+    viewModel(model: Model): ViewModel;
+    resolveLabel(target: Model, row: Record<string, unknown>, labelTemplate?: string): string;
+    resolveFilterableFields(model: Model): Set<string>;
+}
+export declare function createAdminRuntime(config: AdminHandlerConfig): AdminRuntime;