merge dev to main (v3.0.0-beta.31) #500
Conversation
Co-authored-by: ymc9 <[email protected]>
…n "schemas" config (#492) * fix(zmodel): require implicitly used "public" schema to be declared in "schemas" config * Update packages/language/src/validators/datasource-validator.ts Co-authored-by: Copilot <[email protected]> * test: verify "public" schema not required when all models have explicit @@Schema (#496) * Initial plan * Add test for explicit schema usage without public Co-authored-by: ymc9 <[email protected]> --------- Co-authored-by: copilot-swe-agent[bot] <[email protected]> Co-authored-by: ymc9 <[email protected]> --------- Co-authored-by: Copilot <[email protected]> Co-authored-by: Copilot <[email protected]>
WalkthroughA version bump from 3.0.0-beta.30 to 3.0.0-beta.31 across the monorepo, accompanied by updates to template generation, schema validation logic for implicit public schemas, PostgreSQL dialect type-def handling, and policy validation for nonexistent models, along with corresponding test coverage. Changes
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~25 minutes
Possibly related PRs
Poem
Pre-merge checks and finishing touches✅ Passed checks (3 passed)
✨ Finishing touches
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
Claude finished @ymc9's task —— View job PR Review: Merge dev to main (v3.0.0-beta.31)
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🧹 Nitpick comments (1)
tests/e2e/orm/policy/nonexistent-models.test.ts (1)
56-57: Consider adding a test fordelete with using(optional).There's a test for "update with from" (lines 46-54) but no corresponding test for "delete with using", which is also supported per
transformDeleteQueryin the policy handler. Adding this would ensure parity in test coverage.// delete await expect(db.$qb.deleteFrom('Bar').where('id', '=', '1').execute()).toBeRejectedByPolicy(); + + // delete with using (join) + await expect( + db.$qb + .deleteFrom('Foo') + .using('Bar') + .whereRef('Bar.fooId', '=', 'Foo.id') + .execute(), + ).toBeRejectedByPolicy(); }); });
📜 Review details
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (31)
TODO.md(1 hunks)package.json(1 hunks)packages/auth-adapters/better-auth/package.json(1 hunks)packages/cli/package.json(1 hunks)packages/cli/src/actions/templates.ts(1 hunks)packages/clients/tanstack-query/package.json(1 hunks)packages/common-helpers/package.json(1 hunks)packages/config/eslint-config/package.json(1 hunks)packages/config/typescript-config/package.json(1 hunks)packages/config/vitest-config/package.json(1 hunks)packages/create-zenstack/package.json(1 hunks)packages/language/package.json(1 hunks)packages/language/src/validators/datasource-validator.ts(2 hunks)packages/orm/package.json(1 hunks)packages/orm/src/client/crud/dialects/postgresql.ts(2 hunks)packages/plugins/policy/package.json(1 hunks)packages/plugins/policy/src/policy-handler.ts(4 hunks)packages/schema/package.json(1 hunks)packages/sdk/package.json(1 hunks)packages/server/package.json(1 hunks)packages/testtools/package.json(1 hunks)packages/zod/package.json(1 hunks)samples/next.js/package.json(1 hunks)samples/orm/package.json(1 hunks)tests/e2e/orm/client-api/pg-custom-schema.test.ts(1 hunks)tests/e2e/orm/policy/nonexistent-models.test.ts(1 hunks)tests/e2e/package.json(1 hunks)tests/regression/package.json(1 hunks)tests/regression/test/issue-493.test.ts(1 hunks)tests/runtimes/bun/package.json(1 hunks)tests/runtimes/edge-runtime/package.json(1 hunks)
🧰 Additional context used
📓 Path-based instructions (1)
tests/e2e/**/*.{ts,tsx}
📄 CodeRabbit inference engine (CLAUDE.md)
E2E tests should validate real-world schema compatibility with established projects
Files:
tests/e2e/orm/policy/nonexistent-models.test.tstests/e2e/orm/client-api/pg-custom-schema.test.ts
🧠 Learnings (10)
📚 Learning: 2025-11-26T01:55:04.540Z
Learnt from: CR
Repo: zenstackhq/zenstack-v3 PR: 0
File: CLAUDE.md:0-0
Timestamp: 2025-11-26T01:55:04.540Z
Learning: Applies to **/*.zmodel : ZModel schema files should define database structure and policies that compile to TypeScript via `zenstack generate`
Applied to files:
packages/language/package.jsonpackages/schema/package.jsonpackages/plugins/policy/src/policy-handler.tspackages/zod/package.jsonpackages/language/src/validators/datasource-validator.tspackages/cli/src/actions/templates.ts
📚 Learning: 2025-11-26T01:55:04.540Z
Learnt from: CR
Repo: zenstackhq/zenstack-v3 PR: 0
File: CLAUDE.md:0-0
Timestamp: 2025-11-26T01:55:04.540Z
Learning: Applies to tests/e2e/**/*.{ts,tsx} : E2E tests should validate real-world schema compatibility with established projects
Applied to files:
tests/e2e/package.jsontests/regression/test/issue-493.test.tstests/e2e/orm/policy/nonexistent-models.test.tstests/e2e/orm/client-api/pg-custom-schema.test.tspackages/language/src/validators/datasource-validator.ts
📚 Learning: 2025-11-26T01:55:04.540Z
Learnt from: CR
Repo: zenstackhq/zenstack-v3 PR: 0
File: CLAUDE.md:0-0
Timestamp: 2025-11-26T01:55:04.540Z
Learning: Applies to tests/**/type*.{ts,tsx} : Ensure TypeScript inference and type coverage are validated through type coverage tests
Applied to files:
tests/regression/test/issue-493.test.ts
📚 Learning: 2025-11-26T01:55:04.540Z
Learnt from: CR
Repo: zenstackhq/zenstack-v3 PR: 0
File: CLAUDE.md:0-0
Timestamp: 2025-11-26T01:55:04.540Z
Learning: Applies to packages/zenstackhq/orm/**/*.test.{ts,tsx} : ORM package tests should include comprehensive client API tests and policy tests
Applied to files:
tests/regression/test/issue-493.test.tstests/e2e/orm/policy/nonexistent-models.test.tstests/e2e/orm/client-api/pg-custom-schema.test.tspackages/cli/src/actions/templates.tspackages/orm/package.json
📚 Learning: 2025-11-26T01:55:04.540Z
Learnt from: CR
Repo: zenstackhq/zenstack-v3 PR: 0
File: CLAUDE.md:0-0
Timestamp: 2025-11-26T01:55:04.540Z
Learning: Applies to packages/zenstackhq/orm/**/*.{ts,tsx} : Implement plugin hooks at ORM, Kysely, and entity mutation levels for query interception and customization
Applied to files:
tests/e2e/orm/client-api/pg-custom-schema.test.tspackages/orm/src/client/crud/dialects/postgresql.tssamples/orm/package.jsonpackages/cli/src/actions/templates.tspackages/orm/package.json
📚 Learning: 2025-11-26T01:55:04.540Z
Learnt from: CR
Repo: zenstackhq/zenstack-v3 PR: 0
File: CLAUDE.md:0-0
Timestamp: 2025-11-26T01:55:04.540Z
Learning: Applies to packages/zenstackhq/orm/**/*.{ts,tsx} : Use Kysely as the query builder interface for low-level database queries, avoiding raw SQL when possible
Applied to files:
packages/orm/src/client/crud/dialects/postgresql.tspackages/cli/src/actions/templates.tspackages/orm/package.json
📚 Learning: 2025-10-21T16:09:31.218Z
Learnt from: ymc9
Repo: zenstackhq/zenstack-v3 PR: 319
File: packages/runtime/src/client/executor/zenstack-query-executor.ts:63-72
Timestamp: 2025-10-21T16:09:31.218Z
Learning: In ZenStack, TypeDefs can be inherited by models. When a TypeDef contains fields with `map` attributes, those mapped field names need to be processed by the QueryNameMapper since they become part of the inheriting model's schema. Therefore, when checking if a schema has mapped names (e.g., in `schemaHasMappedNames`), both `schema.models` and `schema.typeDefs` must be inspected for `@map` and `map` attributes.
Applied to files:
packages/orm/src/client/crud/dialects/postgresql.ts
📚 Learning: 2025-11-26T01:55:04.540Z
Learnt from: CR
Repo: zenstackhq/zenstack-v3 PR: 0
File: CLAUDE.md:0-0
Timestamp: 2025-11-26T01:55:04.540Z
Learning: Applies to ide/vscode/**/{package.json,version.ts} : The VSCode IDE extension package should maintain a different version from other packages to comply with VSCode Marketplace requirements
Applied to files:
packages/config/typescript-config/package.json
📚 Learning: 2025-11-26T01:55:04.540Z
Learnt from: CR
Repo: zenstackhq/zenstack-v3 PR: 0
File: CLAUDE.md:0-0
Timestamp: 2025-11-26T01:55:04.540Z
Learning: Database migrations should use Prisma CLI under the hood via ZenStack commands
Applied to files:
packages/cli/src/actions/templates.ts
📚 Learning: 2025-11-26T01:55:04.540Z
Learnt from: CR
Repo: zenstackhq/zenstack-v3 PR: 0
File: CLAUDE.md:0-0
Timestamp: 2025-11-26T01:55:04.540Z
Learning: Use `pnpm` with workspaces for package management, pinned to version `pnpm10.12.1`
Applied to files:
package.json
🧬 Code graph analysis (4)
tests/regression/test/issue-493.test.ts (1)
packages/testtools/src/client.ts (1)
createTestClient(101-248)
packages/plugins/policy/src/policy-handler.ts (3)
packages/plugins/policy/src/utils.ts (1)
createRejectedByPolicyError(162-171)packages/orm/src/client/errors.ts (1)
createRejectedByPolicyError(131-141)packages/orm/src/client/index.ts (1)
RejectedByPolicyReason(6-6)
tests/e2e/orm/policy/nonexistent-models.test.ts (1)
packages/testtools/src/client.ts (1)
createPolicyTestClient(258-269)
packages/orm/src/client/crud/dialects/postgresql.ts (1)
packages/orm/src/client/query-utils.ts (1)
isTypeDef(201-203)
🪛 markdownlint-cli2 (0.18.1)
TODO.md
107-107: Unordered list indentation
Expected: 2; Actual: 4
(MD007, ul-indent)
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (3)
- GitHub Check: Agent
- GitHub Check: build-test (20.x, postgresql)
- GitHub Check: build-test (20.x, sqlite)
🔇 Additional comments (35)
packages/schema/package.json (1)
3-3: Version bump consistent with PR objective.packages/zod/package.json (1)
3-3: Version bump consistent; dependencies unchanged.packages/config/vitest-config/package.json (1)
4-4: Version bump is consistent.samples/orm/package.json (1)
3-3: Version bump consistent with monorepo release.packages/sdk/package.json (1)
3-3: Version bump consistent; core SDK package updated.packages/testtools/package.json (1)
3-3: Version bump consistent; testtools package updated.packages/language/package.json (1)
4-4: Version bump consistent; language package updated.packages/cli/package.json (1)
6-6: Version bump consistent; CLI package updated.tests/e2e/package.json (1)
3-3: Version bump consistent with release cycle.Version updated to 3.0.0-beta.31 with no functional changes to test configuration or dependencies.
packages/orm/package.json (1)
3-3: Version bump consistent with release cycle.Version updated to 3.0.0-beta.31 with no changes to exports, dependencies, or public API.
tests/regression/package.json (1)
3-3: Version bump consistent with release cycle.Version updated to 3.0.0-beta.31 with no changes to test configuration or dependencies.
packages/server/package.json (1)
3-3: Version bump consistent with release cycle.Version updated to 3.0.0-beta.31 with no changes to exports, dependencies, or framework adapter compatibility.
packages/clients/tanstack-query/package.json (1)
3-3: Version bump consistent with release cycle.Version updated to 3.0.0-beta.31 with no changes to exports, dependencies, or framework support (React, Vue, Svelte).
package.json (1)
3-3: Version bump consistent with release cycle.Root version updated to 3.0.0-beta.31 with no changes to scripts, dependencies, or workspace configuration.
samples/next.js/package.json (1)
3-3: Version bump consistent with release cycle.Version updated to 3.0.0-beta.31 with no changes to sample configuration or dependencies.
packages/config/typescript-config/package.json (1)
3-3: LGTM! Version bump aligned with release.The version increment to 3.0.0-beta.31 is consistent with the PR's release objectives.
tests/runtimes/bun/package.json (1)
3-3: LGTM! Version bump aligned with release.packages/plugins/policy/package.json (1)
3-3: LGTM! Version bump aligned with release.packages/config/eslint-config/package.json (1)
3-3: LGTM! Version bump aligned with release.packages/common-helpers/package.json (1)
3-3: LGTM! Version bump aligned with release.packages/auth-adapters/better-auth/package.json (1)
3-3: LGTM! Version bump aligned with release.packages/create-zenstack/package.json (1)
3-3: LGTM! Version bump aligned with release.tests/e2e/orm/client-api/pg-custom-schema.test.ts (2)
250-279: Excellent edge case coverage for implicit public schema validation.This test validates that when models or enums lack an explicit
@@schemaattribute, the implicitpublicschema must be declared in theschemasarray. The test structure is clear and the assertion correctly verifies the expected error message.
281-317: Excellent validation of explicit schema declarations.This test validates the complementary case where all models and enums have explicit
@@schemaattributes, correctly demonstrating that thepublicschema is not required in theschemasarray. The test successfully executes create operations and uses appropriate assertions.tests/runtimes/edge-runtime/package.json (1)
3-3: LGTM!Version bump to 3.0.0-beta.31 aligns with the release.
packages/language/src/validators/datasource-validator.ts (1)
3-3: LGTM!Import additions for
isDataModelandisEnumare necessary for the new implicit public schema validation logic.packages/orm/src/client/crud/dialects/postgresql.ts (2)
25-25: LGTM!Import addition for
isTypeDefutility function.
56-76: Good fix for node-pg JSON handling with TypeDef fields.The change correctly addresses the node-pg issue (#374) where array values passed to non-array JSON fields are mishandled. The TypeDef branch ensures:
- TypeDef fields (stored as scalar Json) are stringified regardless of whether they're arrays or scalars.
- Pre-stringified values (e.g., from defaults) are passed through unchanged.
- The existing
Json[]array field handling is preserved.Based on learnings, TypeDefs can be inherited by models, so this fix ensures consistent behavior across the inheritance hierarchy.
tests/regression/test/issue-493.test.ts (1)
1-93: Excellent regression test coverage for issue 493.The test comprehensively validates JSON and typed-JSON handling for PostgreSQL:
- Plain
Jsonfield with object value- Plain
Jsonfield with array value (the node-pg edge case)- Typed-JSON with nested custom types (
BotButton[]containingInlineButton[])The schema design effectively exercises nested type-def scenarios that align with the
transformPrimitivefix in the PostgreSQL dialect.packages/cli/src/actions/templates.ts (2)
35-40: LGTM!Renaming
clienttodbfollows common convention for database instance naming and improves readability of the starter template.
30-30: Good improvement to use ZenStack's re-exported dialect.Changing the import from
kyselyto@zenstackhq/orm/dialects/sqliteprovides a cleaner API surface for users and avoids exposing internal Kysely dependencies in starter templates. The dialect is properly re-exported through ZenStack's package, maintaining the abstraction layer.packages/plugins/policy/src/policy-handler.ts (3)
91-93: Appropriate placement of the nonexistent model check for mutations.The check is correctly placed after
getMutationModel()and before any policy evaluation or mutation work begins. This ensures early rejection for invalid models in insert, update, and delete operations.
329-337: Join transformation correctly validates model existence.The check after
extractTableNameensures that joins against nonexistent models are rejected. The fallback for subqueries (returning early whentableis undefined) is preserved, allowing nested transformation to handle those cases.
874-885: Policy filter creation validates models in FROM clause.The validation inside
createPolicyFilterForTablesensures that any table referenced in FROM or USING clauses is checked before building policy filters. This covers read operations viaselectFromand delete operations withusing.tests/e2e/orm/policy/nonexistent-models.test.ts (1)
4-58: Comprehensive test coverage for nonexistent model rejection.The test effectively validates the new
tryRejectNonexistentModelguard across all CRUD operations:
- Read via
selectFrom- Join via
innerJoin- Create via
insertInto- Update via
updateTable- Update with FROM clause
- Delete via
deleteFromThe setup correctly creates an out-of-schema table to simulate real-world scenarios where raw SQL might reference tables not defined in the ZModel schema. This aligns with the E2E testing guideline to validate real-world schema compatibility.
There was a problem hiding this comment.
Pull request overview
This PR merges the dev branch to main for the v3.0.0-beta.31 release. It includes bug fixes for PostgreSQL typed-JSON handling, security improvements for policy enforcement with nonexistent models, and validation enhancements for PostgreSQL schema configuration.
Key changes:
- Fixed PostgreSQL dialect to properly stringify TypeDef (typed-JSON) fields before storage, addressing issue #493
- Enhanced policy handler to reject queries on nonexistent models for security
- Improved datasource validator to require "public" schema in schemas array when models/enums implicitly use it
Reviewed changes
Copilot reviewed 31 out of 31 changed files in this pull request and generated no comments.
Show a summary per file
| File | Description |
|---|---|
| package.json | Version bump to 3.0.0-beta.31 |
| packages/orm/src/client/crud/dialects/postgresql.ts | Fixed TypeDef field handling: now checks isTypeDef before array type to properly stringify typed-JSON fields |
| packages/plugins/policy/src/policy-handler.ts | Added tryRejectNonexistentModel method to reject queries on models not in schema for security |
| packages/language/src/validators/datasource-validator.ts | Added validation to require "public" in schemas array when models/enums use it implicitly |
| packages/cli/src/actions/templates.ts | Updated template to import SqliteDialect from @zenstackhq/orm/dialects/sqlite and use "db" naming convention |
| tests/regression/test/issue-493.test.ts | New regression test for PostgreSQL JSON and typed-JSON array field handling |
| tests/e2e/orm/policy/nonexistent-models.test.ts | New test verifying policy rejection for nonexistent models |
| tests/e2e/orm/client-api/pg-custom-schema.test.ts | New tests for implicit public schema validation in PostgreSQL |
| TODO.md | Marked "Accessing tables not in the schema" as complete |
| All other package.json files | Version bumps to 3.0.0-beta.31 |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Summary by CodeRabbit
Chores
New Features
Tests
✏️ Tip: You can customize this high-level summary in your review settings.