sveltekit-admin 0.6.0 → 0.9.0

package/README.md

@@ -16,6 +16,8 @@ See [CHANGELOG.md](./CHANGELOG.md) for release notes and breaking changes, and
 - ⚡ **Zero routes** - everything handled via a single hook
 - 🪶 **3 lines of code** to setup
 - 🔧 **Customizable** - hide fields, set readonly, custom labels
+- 📋 **Audit log** - optional callback after every successful write
+- 🧩 **Plugins** - optional extra pages and record actions (`plugins: []`)
 - 🔌 **Drizzle adapter** (optional subpath export)
 
 ## Installation
@@ -46,12 +48,12 @@ That's it! Navigate to `/admin` and you'll see:
 
 ## Drizzle
 
-Prisma stays the default. For Drizzle, pass an adapter from the subpath
-export (this does not pull in `drizzle-orm` for Prisma apps):
+Prisma stays the default on the root entry (`createAdminHandler({ prisma })`).
+For Drizzle, import **both** the handler and the adapter from the subpath
+so a Drizzle-only app never evaluates the Prisma adapter modules:
 
 ```typescript
-import { createAdminHandler } from 'sveltekit-admin';
-import { createDrizzleAdapter } from 'sveltekit-admin/adapters/drizzle';
+import { createAdminHandler, createDrizzleAdapter } from 'sveltekit-admin/adapters/drizzle';
 import { db } from './db';
 import * as schema from './db/schema';
 
@@ -61,6 +63,10 @@ export const handle = createAdminHandler({
 });
 ```
 
+Importing `createAdminHandler` from `sveltekit-admin` and the adapter from
+the subpath still works, but it loads the Prisma adapter JavaScript (it does
+not require installing `@prisma/client`).
+
 Pass the same `schema` object you already export (tables + `relations()`).
 Model names in `config.models` are the JS export keys (`users`, not `User`).
 `config.search.mode` only applies to `createAdminHandler({ prisma })`;
@@ -163,6 +169,37 @@ prefetch would allow), and this route is checked *before* `authCheck`, so
 a user whose session already expired can still use it to clean up
 client-side state instead of being stuck behind a 401 with no way back.
 
+### Audit log
+
+Same philosophy as `authCheck` / `logout`: the library has no log table of
+its own. Provide an `audit` callback and it is called after every
+**successful** create, update, or delete with a redacted `AuditEvent`.
+The actor is whatever you already put on `event.locals`. Sensitive and
+`hidden` fields are stripped. If the callback throws, the mutation still
+redirects.
+
+```typescript
+const adminHandle = createAdminHandler({
+  prisma,
+  authCheck: (event) => event.locals.session?.user?.role === 'admin',
+  audit: async (entry) => {
+    await prisma.auditLog.create({
+      data: {
+        at: entry.at,
+        actorId: entry.event.locals.session?.user?.id,
+        action: entry.action,
+        model: entry.model,
+        recordId: String(entry.id),
+        changes: entry.action === 'update' ? entry.changes : undefined
+      }
+    });
+  }
+});
+```
+
+No callback means no behaviour change. Persist to your own model if you
+want the log to appear in the admin like any other table.
+
 ## How It Works
 
 The admin handler intercepts all requests to `/admin/*` and:
@@ -177,6 +214,26 @@ Routes handled:
 - `/admin/user/new` → Create user form
 - `/admin/user/123` → Edit user form
 
+## Plugins
+
+Pass `plugins` to register extra admin pages (SSR HTML + inline CSS/JS)
+and links on edit screens and list rows. See the exported `AdminPlugin`
+type and the documentation site's Plugins page.
+
+```typescript
+createAdminHandler({
+  prisma,
+  plugins: [
+    {
+      name: 'hello',
+      pages: [{ pattern: ['hello'], render: () => ({ html: '<p>Hello</p>' }) }]
+    }
+  ]
+});
+```
+
+Omit `plugins` and the admin is unchanged.
+
 ## Model Configuration
 
 ```typescript

package/dist/index.d.ts

@@ -2,9 +2,11 @@
  * SvelteKit Admin
  * Django-like admin panel for SvelteKit + Prisma
  */
-export { createAdminHandler, type AdminHandlerConfig } from './server/handler.js';
+export { createAdminHandler, type AdminHandlerConfig } from './server/adapters/prisma/handler.js';
 export { defaultAdminCheck } from './server/auth.js';
+export type { AuditAction, AuditEvent } from './server/audit.js';
 export { parsePrismaSchema, parseSchemaContent, type PrismaSchema, type PrismaModel, type PrismaField } from './server/introspection/parser.js';
 export type { Schema, Model, Field } from './server/types/schema.js';
 export { createPrismaAdapter } from './server/adapters/prisma/index.js';
 export type { DataAdapter, SchemaIntrospector, Filter } from './server/adapters/types.js';
+export type { AdminPlugin, AdminPluginPage, AdminPluginRecordAction, PluginPageContext, PluginPageResult } from './server/plugin.js';

package/dist/index.js

@@ -2,7 +2,7 @@
  * SvelteKit Admin
  * Django-like admin panel for SvelteKit + Prisma
  */
-export { createAdminHandler } from './server/handler.js';
+export { createAdminHandler } from './server/adapters/prisma/handler.js';
 export { defaultAdminCheck } from './server/auth.js';
 export { parsePrismaSchema, parseSchemaContent } from './server/introspection/parser.js';
 export { createPrismaAdapter } from './server/adapters/prisma/index.js';

package/dist/server/adapters/drizzle/dataAdapter.js

@@ -1,5 +1,6 @@
-import { asc, count, desc, eq, getTableColumns } from "drizzle-orm";
+import { and, asc, count, desc, eq, getTableColumns, inArray } from "drizzle-orm";
 import { coerceId, primaryKeyOf } from "../../data.js";
+import { withWriteRetry } from "../retry.js";
 import { compileFilterToDrizzle } from "./filterCompiler.js";
 function tableFor(ctx, model) {
     const table = ctx.tables[model.name];
@@ -11,11 +12,73 @@ function tableFor(ctx, model) {
 function primaryKeyColumn(table, model) {
     return getTableColumns(table)[primaryKeyOf(model)];
 }
-async function selectByPrimaryKey(db, table, model, id) {
+/**
+ * Résolution d'une colonne par nom, partagée par les deux chemins de tri
+ * (`listRecords` pour `?sort=`, `findMany` pour un `orderBy` de config). Un
+ * nom inconnu lève : côté `?sort=` il ne peut pas arriver — `sortQuery.ts` ne
+ * laisse sortir que des colonnes rendues — donc s'il arrive, c'est la table
+ * Drizzle qui ne correspond pas au schéma introspecté, et échouer fort vaut
+ * mieux qu'un tri silencieusement absent.
+ */
+function columnFor(table, field) {
+    const column = getTableColumns(table)[field];
+    if (!column) {
+        throw new Error(`[sveltekit-admin] unknown field '${field}' on Drizzle table`);
+    }
+    return column;
+}
+/**
+ * Ordre de verrouillage déterministe. Les guards m2m sont empilés dans l'ordre
+ * des ids soumis par le formulaire, donc sous contrôle du client : deux
+ * requêtes concurrentes envoyant [1,2] et [2,1] verrouilleraient les mêmes
+ * lignes en sens inverse et se deadlockeraient (PostgreSQL 40P01), ce qui est
+ * bien plus facile à déclencher que la course qu'on cherche à empêcher.
+ * Trier sur (modèle, pk) donne un ordre total stable et supprime le cycle.
+ */
+function orderedGuards(guards) {
+    return [...guards].sort((a, b) => a.targetModel.name.localeCompare(b.targetModel.name) ||
+        String(a.targetPk).localeCompare(String(b.targetPk)));
+}
+async function validateTargetGuards(ctx, tx, guards, compile) {
+    for (const guard of orderedGuards(guards)) {
+        const table = tableFor(ctx, guard.targetModel);
+        const where = and(eq(primaryKeyColumn(table, guard.targetModel), guard.targetPk), compile(table, guard.filter));
+        const query = tx.select().from(table).where(where).limit(1);
+        // Verrou partagé tenu jusqu'au commit, PostgreSQL uniquement.
+        //
+        // Mesuré (PG 16, les 4 combinaisons) : SERIALIZABLE seul n'annule PAS la
+        // séquence « lire le guard -> un tiers sort la cible du scope -> écrire ».
+        // SSI n'y voit aucun cycle de dépendances, donc cet ordre reste
+        // sérialisable et les deux transactions committent. Seul le verrou de
+        // ligne ferme la fenêtre. Ne pas le retirer en pensant que le niveau
+        // d'isolation suffit : c'est faux, et ça a été vérifié.
+        //
+        // MySQL est exclu volontairement : SERIALIZABLE y transforme déjà les
+        // SELECT en lectures verrouillantes (mesuré : le writer concurrent est
+        // bloqué), donc le verrou n'apporterait rien — et `for share` est une
+        // syntaxe 8.0+, l'émettre casserait les schémas encore en 5.7.
+        const rows = await (ctx.dialect === "postgresql" ? query.for("share") : query);
+        if (rows.length === 0)
+            throw new Error("relation target is outside the authorization scope");
+    }
+}
+function validateTargetGuardsSqlite(ctx, tx, guards, compile) {
+    // Pas de clause de verrou en SQLite (absente de sqlite-core, et inutile :
+    // l'écriture concurrente échoue fermée, cf. le commentaire ci-dessus).
+    for (const guard of orderedGuards(guards)) {
+        const table = tableFor(ctx, guard.targetModel);
+        const where = and(eq(primaryKeyColumn(table, guard.targetModel), guard.targetPk), compile(table, guard.filter));
+        const row = tx.select().from(table).where(where).limit(1).get();
+        if (!row)
+            throw new Error("relation target is outside the authorization scope");
+    }
+}
+async function selectByPrimaryKey(db, table, model, id, authorizationFilter) {
+    const primaryKeyWhere = eq(primaryKeyColumn(table, model), coerceId(String(id), model));
     const rows = await db
         .select()
         .from(table)
-        .where(eq(primaryKeyColumn(table, model), coerceId(String(id), model)))
+        .where(authorizationFilter ? and(primaryKeyWhere, authorizationFilter) : primaryKeyWhere)
         .limit(1);
     return rows[0] ?? null;
 }
@@ -32,15 +95,23 @@ async function insertAndReturn(db, table, model, scalars, dialect) {
     const rows = await db.insert(table).values(scalars).returning();
     return rows[0];
 }
-async function updateAndReturn(db, table, model, id, scalars, dialect) {
+async function updateAndReturn(db, table, model, id, scalars, dialect, authorizationFilter) {
     const coercedId = coerceId(String(id), model);
-    const where = eq(primaryKeyColumn(table, model), coercedId);
+    const where = authorizationFilter
+        ? and(eq(primaryKeyColumn(table, model), coercedId), authorizationFilter)
+        : eq(primaryKeyColumn(table, model), coercedId);
     if (dialect === "mysql") {
         await db.update(table).set(scalars).where(where);
-        return (await selectByPrimaryKey(db, table, model, coercedId));
+        const row = await selectByPrimaryKey(db, table, model, coercedId, authorizationFilter);
+        if (!row)
+            throw new Error("record is outside the authorization scope");
+        return row;
     }
     const rows = await db.update(table).set(scalars).where(where).returning();
-    return rows[0];
+    const row = rows[0];
+    if (!row)
+        throw new Error("record is outside the authorization scope");
+    return row;
 }
 async function insertM2mRows(db, link, parentId, ids) {
     if (ids.length === 0)
@@ -53,13 +124,16 @@ async function insertM2mRows(db, link, parentId, ids) {
 function insertAndReturnSqlite(db, table, scalars) {
     return db.insert(table).values(scalars).returning().get();
 }
-function updateAndReturnSqlite(db, table, model, id, scalars) {
-    return db
+function updateAndReturnSqlite(db, table, model, id, scalars, authorizationFilter) {
+    const row = db
         .update(table)
         .set(scalars)
-        .where(eq(primaryKeyColumn(table, model), coerceId(String(id), model)))
+        .where(authorizationFilter ? and(eq(primaryKeyColumn(table, model), coerceId(String(id), model)), authorizationFilter) : eq(primaryKeyColumn(table, model), coerceId(String(id), model)))
         .returning()
         .get();
+    if (!row)
+        throw new Error("record is outside the authorization scope");
+    return row;
 }
 function insertM2mRowsSqlite(db, link, parentId, ids) {
     if (ids.length === 0)
@@ -81,12 +155,23 @@ export function createDrizzleDataAdapter(db, ctx) {
             const table = tableFor(ctx, model);
             const where = compileHere(table, opts.filter);
             const primaryKey = primaryKeyColumn(table, model);
+            const requested = opts.orderBy;
+            // Départage systématique par la clé primaire, sauf quand c'est elle qu'on
+            // trie : deux lignes de même valeur doivent garder le même rang d'une
+            // requête à l'autre, sinon la fenêtre skip/take fait sauter des lignes.
+            const orderBy = !requested
+                ? [desc(primaryKey)]
+                : (() => {
+                    const column = columnFor(table, requested.field);
+                    const primary = column === primaryKey ? [] : [desc(primaryKey)];
+                    return [requested.dir === "asc" ? asc(column) : desc(column), ...primary];
+                })();
             const [rows, totals] = await Promise.all([
                 db
                     .select()
                     .from(table)
                     .where(where)
-                    .orderBy(desc(primaryKey))
+                    .orderBy(...orderBy)
                     .limit(opts.take)
                     .offset(opts.skip),
                 db.select({ n: count() }).from(table).where(where),
@@ -95,12 +180,8 @@ export function createDrizzleDataAdapter(db, ctx) {
         },
         async findMany(model, opts) {
             const table = tableFor(ctx, model);
-            const columns = getTableColumns(table);
             const orderBy = Object.entries(opts.orderBy ?? {}).map(([field, direction]) => {
-                const column = columns[field];
-                if (!column) {
-                    throw new Error(`[sveltekit-admin] unknown field '${field}' on Drizzle table`);
-                }
+                const column = columnFor(table, field);
                 return direction === "asc" ? asc(column) : desc(column);
             });
             let query = db
@@ -138,11 +219,13 @@ export function createDrizzleDataAdapter(db, ctx) {
         async createRecord(model, input) {
             const table = tableFor(ctx, model);
             const m2mFields = Object.entries(input.m2m ?? {});
-            if (m2mFields.length === 0) {
+            const guards = input.targetGuards ?? [];
+            if (m2mFields.length === 0 && guards.length === 0) {
                 return insertAndReturn(db, table, model, input.scalars, ctx.dialect);
             }
             if (ctx.dialect === "sqlite") {
                 return db.transaction((tx) => {
+                    validateTargetGuardsSqlite(ctx, tx, guards, compileHere);
                     const parent = insertAndReturnSqlite(tx, table, input.scalars);
                     const parentId = parent[primaryKeyOf(model)];
                     for (const [field, relation] of m2mFields) {
@@ -152,9 +235,10 @@ export function createDrizzleDataAdapter(db, ctx) {
                         insertM2mRowsSqlite(tx, link, parentId, relation.ids);
                     }
                     return parent;
-                });
+                }, { behavior: "immediate" });
             }
-            return db.transaction(async (tx) => {
+            return withWriteRetry(() => db.transaction(async (tx) => {
+                await validateTargetGuards(ctx, tx, guards, compileHere);
                 const parent = await insertAndReturn(tx, table, model, input.scalars, ctx.dialect);
                 const parentId = parent[primaryKeyOf(model)];
                 for (const [field, relation] of m2mFields) {
@@ -164,17 +248,19 @@ export function createDrizzleDataAdapter(db, ctx) {
                     await insertM2mRows(tx, link, parentId, relation.ids);
                 }
                 return parent;
-            });
+            }, { isolationLevel: "serializable" }));
         },
-        async updateRecord(model, id, input) {
+        async updateRecord(model, id, input, authorizationFilter) {
             const table = tableFor(ctx, model);
             const m2mFields = Object.entries(input.m2m ?? {});
-            if (m2mFields.length === 0) {
-                return updateAndReturn(db, table, model, id, input.scalars, ctx.dialect);
+            const guards = input.targetGuards ?? [];
+            if (m2mFields.length === 0 && guards.length === 0) {
+                return updateAndReturn(db, table, model, id, input.scalars, ctx.dialect, compileHere(table, authorizationFilter));
             }
             if (ctx.dialect === "sqlite") {
                 return db.transaction((tx) => {
-                    const parent = updateAndReturnSqlite(tx, table, model, id, input.scalars);
+                    validateTargetGuardsSqlite(ctx, tx, guards, compileHere);
+                    const parent = updateAndReturnSqlite(tx, table, model, id, input.scalars, compileHere(table, authorizationFilter));
                     const parentId = coerceId(String(id), model);
                     for (const [field, relation] of m2mFields) {
                         const link = ctx.m2m.get(`${model.name}.${field}`);
@@ -184,10 +270,11 @@ export function createDrizzleDataAdapter(db, ctx) {
                         insertM2mRowsSqlite(tx, link, parentId, relation.ids);
                     }
                     return parent;
-                });
+                }, { behavior: "immediate" });
             }
-            return db.transaction(async (tx) => {
-                const parent = await updateAndReturn(tx, table, model, id, input.scalars, ctx.dialect);
+            return withWriteRetry(() => db.transaction(async (tx) => {
+                await validateTargetGuards(ctx, tx, guards, compileHere);
+                const parent = await updateAndReturn(tx, table, model, id, input.scalars, ctx.dialect, compileHere(table, authorizationFilter));
                 const parentId = coerceId(String(id), model);
                 for (const [field, relation] of m2mFields) {
                     const link = ctx.m2m.get(`${model.name}.${field}`);
@@ -197,37 +284,104 @@ export function createDrizzleDataAdapter(db, ctx) {
                     await insertM2mRows(tx, link, parentId, relation.ids);
                 }
                 return parent;
-            });
+            }, { isolationLevel: "serializable" }));
         },
-        async deleteRecord(model, id) {
+        async deleteRecord(model, id, authorizationFilter) {
             const table = tableFor(ctx, model);
             const coercedId = coerceId(String(id), model);
             const links = [...ctx.m2m.entries()]
                 .filter(([key]) => key.startsWith(`${model.name}.`))
                 .map(([, link]) => link);
+            const parentWhere = and(eq(primaryKeyColumn(table, model), coercedId), compileHere(table, authorizationFilter));
             if (links.length === 0) {
-                await db
-                    .delete(table)
-                    .where(eq(primaryKeyColumn(table, model), coercedId));
+                if (ctx.dialect === "sqlite") {
+                    const result = db.delete(table).where(parentWhere).run();
+                    if (result.changes !== 1)
+                        throw new Error("record is outside the authorization scope");
+                }
+                else {
+                    const result = await db.delete(table).where(parentWhere);
+                    if (Number(result?.affectedRows ?? 0) !== 1)
+                        throw new Error("record is outside the authorization scope");
+                }
                 return;
             }
+            // Les pivots partent avant le parent, l'ordre qu'imposent les FK. Le DELETE
+            // scopé du parent sert lui-même de garde : zéro ligne touchée => throw =>
+            // rollback des pivots. Pas de SELECT de vérification préalable, donc aucune
+            // fenêtre TOCTOU entre la lecture du scope et la suppression, et aucune
+            // branche défensive inatteignable.
             if (ctx.dialect === "sqlite") {
                 db.transaction((tx) => {
-                    for (const link of links) {
+                    for (const link of links)
                         tx.delete(link.pivot).where(eq(link.selfColumn, coercedId)).run();
-                    }
-                    tx.delete(table)
-                        .where(eq(primaryKeyColumn(table, model), coercedId))
-                        .run();
-                });
+                    const result = tx.delete(table).where(parentWhere).run();
+                    if (result.changes !== 1)
+                        throw new Error("record is outside the authorization scope");
+                }, { behavior: "immediate" });
                 return;
             }
-            await db.transaction(async (tx) => {
-                for (const link of links) {
+            await withWriteRetry(() => db.transaction(async (tx) => {
+                for (const link of links)
                     await tx.delete(link.pivot).where(eq(link.selfColumn, coercedId));
+                if (ctx.dialect === "postgresql") {
+                    const deleted = await tx.delete(table).where(parentWhere).returning({ id: primaryKeyColumn(table, model) });
+                    if (deleted.length !== 1)
+                        throw new Error("record is outside the authorization scope");
                 }
-                await tx.delete(table).where(eq(primaryKeyColumn(table, model), coercedId));
-            });
+                else {
+                    const result = await tx.delete(table).where(parentWhere);
+                    if (Number(result?.affectedRows ?? 0) !== 1)
+                        throw new Error("record is outside the authorization scope");
+                }
+            }, { isolationLevel: "serializable" }));
+        },
+        async deleteMany(model, ids, authorizationFilter) {
+            const table = tableFor(ctx, model);
+            const primaryKey = primaryKeyColumn(table, model);
+            const coerced = ids.map((id) => coerceId(String(id), model));
+            const scopedWhere = and(inArray(primaryKey, coerced), compileHere(table, authorizationFilter));
+            const links = [...ctx.m2m.entries()]
+                .filter(([key]) => key.startsWith(`${model.name}.`))
+                .map(([, link]) => link);
+            /**
+             * Les ids réellement concernés sont LUS avant de toucher quoi que ce
+             * soit, à l'intérieur de la transaction. Ce n'est pas une vérification
+             * défensive : les pivots m2m doivent être supprimés pour ces lignes-là et
+             * pas pour les autres. Composer le scope directement dans le DELETE des
+             * pivots effacerait les liaisons d'une ligne hors portée que le DELETE du
+             * parent, lui, ne toucherait pas — une ligne d'un autre tenant amputée de
+             * ses relations sans que rien ne l'indique.
+             *
+             * `deleteRecord` peut s'en passer parce qu'il vise UNE ligne et lève quand
+             * elle n'est pas dans la portée, ce qui annule tout. Ici une portée
+             * partielle est un résultat normal, pas une erreur : le compte renvoyé est
+             * celui des lignes supprimées.
+             */
+            if (ctx.dialect === "sqlite") {
+                return db.transaction((tx) => {
+                    const matched = tx.select({ id: primaryKey }).from(table).where(scopedWhere).all()
+                        .map((row) => row.id);
+                    if (matched.length === 0)
+                        return 0;
+                    for (const link of links) {
+                        tx.delete(link.pivot).where(inArray(link.selfColumn, matched)).run();
+                    }
+                    tx.delete(table).where(inArray(primaryKey, matched)).run();
+                    return matched.length;
+                }, { behavior: "immediate" });
+            }
+            return withWriteRetry(() => db.transaction(async (tx) => {
+                const rows = await tx.select({ id: primaryKey }).from(table).where(scopedWhere);
+                const matched = rows.map((row) => row.id);
+                if (matched.length === 0)
+                    return 0;
+                for (const link of links) {
+                    await tx.delete(link.pivot).where(inArray(link.selfColumn, matched));
+                }
+                await tx.delete(table).where(inArray(primaryKey, matched));
+                return matched.length;
+            }, { isolationLevel: "serializable" }));
         },
         async getM2mSelectedIds(model, edge, _targetModel, recordId) {
             const link = ctx.m2m.get(`${model.name}.${edge.field}`);

package/dist/server/adapters/drizzle/index.d.ts

@@ -1,6 +1,15 @@
-import type { DataAdapter, SchemaIntrospector } from "../types.js";
+import { defaultAdminCheck } from "../../auth.js";
+import { createAdminHandler, type AdminHandlerConfig } from "../../handler.js";
+import type { Schema, Model, Field } from "../../types/schema.js";
+import type { DataAdapter, Filter, SchemaIntrospector } from "../types.js";
 import type { DrizzleDialect } from "./inspect.js";
+export { createAdminHandler, type AdminHandlerConfig };
+export { defaultAdminCheck };
+export type { AuditAction, AuditEvent } from "../../audit.js";
+export type { Schema, Model, Field };
+export type { DataAdapter, SchemaIntrospector, Filter };
 export type { DrizzleDialect };
+export type { AdminPlugin, AdminPluginPage, AdminPluginRecordAction, PluginPageContext, PluginPageResult, } from "../../plugin.js";
 export declare function resolveCaseInsensitiveSearch(dialect: DrizzleDialect, searchMode?: "auto" | "insensitive" | "default"): boolean;
 export declare function createDrizzleAdapter(opts: {
     db: any;

package/dist/server/adapters/drizzle/index.js

@@ -1,6 +1,10 @@
+import { defaultAdminCheck } from "../../auth.js";
+import { createAdminHandler } from "../../handler.js";
 import { createDrizzleDataAdapter } from "./dataAdapter.js";
 import { inspectDrizzleSchema } from "./inspect.js";
 import { createDrizzleIntrospector } from "./introspector.js";
+export { createAdminHandler };
+export { defaultAdminCheck };
 export function resolveCaseInsensitiveSearch(dialect, searchMode = "auto") {
     if (searchMode === "insensitive")
         return true;

package/dist/server/adapters/prisma/dataAdapter.js

@@ -1,5 +1,38 @@
 import { toPrismaModel, primaryKeyOf, coerceId } from '../../data.js';
 import { compileFilterToPrismaWhere } from './filterCompiler.js';
+import { withWriteRetry } from '../retry.js';
+/**
+ * Revalidation des cibles de relation à l'intérieur de la transaction d'écriture.
+ *
+ * Fenêtre résiduelle, assumée : cette lecture ne pose aucun verrou de ligne.
+ * Sur PostgreSQL, `Serializable` ne l'empêche PAS — mesuré sur PG 16 : SSI ne
+ * voit aucun cycle de dépendances dans « lire le guard -> un tiers sort la
+ * cible du scope -> écrire », donc les deux transactions committent. L'adapter
+ * Drizzle ferme cette fenêtre avec un `FOR SHARE` ; Prisma n'expose aucune API
+ * de verrou, et l'émettre demanderait du `$queryRaw` par dialecte, donc les
+ * noms physiques de tables et colonnes (les `@@map`/`@map` ne sont pas parsés)
+ * et un second compilateur de filtres à garder en phase avec
+ * `compileFilterToPrismaWhere` — exactement le duplicata divergent que ce
+ * codebase a déjà payé une fois.
+ *
+ * L'exposition reste bornée : `mutations.ts` a déjà revalidé chaque FK et m2m
+ * par un `findFirst` scopé avant d'appeler l'adapter, et gagner cette course
+ * ne produit qu'une référence orpheline inter-tenant — aucune lecture des
+ * données de l'autre tenant, le scoping des dropdowns et la « chip » anti-oracle
+ * tenant par ailleurs. C'est un défaut d'intégrité, pas une divulgation.
+ */
+async function validateTargetGuards(tx, guards, compile) {
+    for (const guard of guards) {
+        const key = toPrismaModel(guard.targetModel.name);
+        const pk = primaryKeyOf(guard.targetModel);
+        const where = guard.filter
+            ? { [pk]: guard.targetPk, AND: [compile(guard.filter)] }
+            : { [pk]: guard.targetPk };
+        if (!(await tx[key].findFirst({ where }))) {
+            throw new Error('relation target is outside the authorization scope');
+        }
+    }
+}
 /**
  * Prisma implementation of `DataAdapter`. `caseInsensitiveSearch` is fixed
  * at construction time (Task 5's boot block resolves it from the schema's
@@ -16,8 +49,17 @@ export function createPrismaDataAdapter(prisma, opts = {}) {
             const key = toPrismaModel(model.name);
             const primaryKey = primaryKeyOf(model);
             const where = compileHere(listOpts.filter);
+            const requested = listOpts.orderBy;
+            // Objet (et non tableau à un élément) quand rien n'est demandé : c'est la
+            // forme historique, et la garder évite de faire bouger des attentes de
+            // tests qui ne parlent pas de tri.
+            const orderBy = !requested
+                ? { [primaryKey]: 'desc' }
+                : requested.field === primaryKey
+                    ? [{ [primaryKey]: requested.dir }]
+                    : [{ [requested.field]: requested.dir }, { [primaryKey]: 'desc' }];
             const [rows, total] = await Promise.all([
-                prisma[key].findMany({ where, skip: listOpts.skip, take: listOpts.take, orderBy: { [primaryKey]: 'desc' } }),
+                prisma[key].findMany({ where, skip: listOpts.skip, take: listOpts.take, orderBy }),
                 prisma[key].count({ where })
             ]);
             return { rows, total };
@@ -44,38 +86,56 @@ export function createPrismaDataAdapter(prisma, opts = {}) {
         async createRecord(model, input) {
             const key = toPrismaModel(model.name);
             const m2mFields = Object.keys(input.m2m ?? {});
-            if (m2mFields.length === 0) {
+            const guards = input.targetGuards ?? [];
+            if (m2mFields.length === 0 && guards.length === 0) {
                 return prisma[key].create({ data: input.scalars });
             }
-            return prisma.$transaction(async (tx) => {
+            return withWriteRetry(() => prisma.$transaction(async (tx) => {
+                await validateTargetGuards(tx, guards, compileHere);
                 const data = { ...input.scalars };
                 for (const field of m2mFields) {
                     const { targetPkField, ids } = input.m2m[field];
                     data[field] = { connect: ids.map((id) => ({ [targetPkField]: id })) };
                 }
                 return tx[key].create({ data });
-            });
+            }, { isolationLevel: "Serializable" }));
         },
-        async updateRecord(model, id, input) {
+        async updateRecord(model, id, input, authorizationFilter) {
             const key = toPrismaModel(model.name);
             const primaryKey = primaryKeyOf(model);
-            const where = { [primaryKey]: coerceId(String(id), model) };
+            const where = authorizationFilter
+                ? { [primaryKey]: coerceId(String(id), model), AND: [compileHere(authorizationFilter)] }
+                : { [primaryKey]: coerceId(String(id), model) };
             const m2mFields = Object.keys(input.m2m ?? {});
-            if (m2mFields.length === 0) {
+            const guards = input.targetGuards ?? [];
+            if (m2mFields.length === 0 && guards.length === 0) {
                 return prisma[key].update({ where, data: input.scalars });
             }
-            return prisma.$transaction(async (tx) => {
+            return withWriteRetry(() => prisma.$transaction(async (tx) => {
+                await validateTargetGuards(tx, guards, compileHere);
                 const data = { ...input.scalars };
                 for (const field of m2mFields) {
                     const { targetPkField, ids } = input.m2m[field];
                     data[field] = { set: ids.map((id) => ({ [targetPkField]: id })) };
                 }
                 return tx[key].update({ where, data });
-            });
+            }, { isolationLevel: "Serializable" }));
+        },
+        async deleteRecord(model, id, authorizationFilter) {
+            const primaryKey = primaryKeyOf(model);
+            const where = authorizationFilter
+                ? { [primaryKey]: coerceId(String(id), model), AND: [compileHere(authorizationFilter)] }
+                : { [primaryKey]: coerceId(String(id), model) };
+            await prisma[toPrismaModel(model.name)].delete({ where });
         },
-        async deleteRecord(model, id) {
+        async deleteMany(model, ids, authorizationFilter) {
             const primaryKey = primaryKeyOf(model);
-            await prisma[toPrismaModel(model.name)].delete({ where: { [primaryKey]: coerceId(String(id), model) } });
+            const coerced = ids.map((id) => coerceId(String(id), model));
+            const where = authorizationFilter
+                ? { [primaryKey]: { in: coerced }, AND: [compileHere(authorizationFilter)] }
+                : { [primaryKey]: { in: coerced } };
+            const { count } = await prisma[toPrismaModel(model.name)].deleteMany({ where });
+            return count;
         },
         async getM2mSelectedIds(model, edge, targetModel, recordId) {
             try {

package/dist/server/adapters/prisma/handler.d.ts

@@ -0,0 +1,14 @@
+import { type AdminHandlerConfig as CoreAdminHandlerConfig } from '../../handler.js';
+export interface AdminHandlerConfig extends Omit<CoreAdminHandlerConfig, 'adapter' | 'prisma' | 'prismaSchemaPath' | 'search'> {
+    prisma?: any;
+    prismaSchemaPath?: string;
+    adapter?: CoreAdminHandlerConfig['adapter'];
+    search?: {
+        mode?: 'auto' | 'insensitive' | 'default';
+    };
+}
+export declare function createAdminHandler(config: AdminHandlerConfig): ({ event, resolve }: {
+    event: any;
+    resolve: (event: any) => Response | Promise<Response>;
+}) => Promise<Response>;
+export type { AdminPlugin, AdminPluginPage, AdminPluginRecordAction, PluginPageContext, PluginPageResult } from '../../plugin.js';