feat: add support for compound unique constraints

db/migrations/20260202093502_unique_fields/migration.sql

@@ -0,0 +1,8 @@
+/*
+  Warnings:
+
+  - A unique constraint covering the columns `[title,categoryId]` on the table `Post` will be added. If there are existing duplicate values, this will fail.
+
+*/
+-- CreateIndex
+CREATE UNIQUE INDEX "Post_title_categoryId_key" ON "Post"("title", "categoryId");

db/schema.prisma

@@ -24,19 +24,21 @@ model Post {
   published  Boolean   @default(false)
   viewCount  Int       @default(0)
   categoryId Int
-  author     User?     @relation(fields: [authorId], references: [id])
   authorId   Int?
   comments   Comment[]
+  author     User?     @relation(fields: [authorId], references: [id])
   category   Category  @relation(fields: [categoryId], references: [id])
+
+  @@unique([title, categoryId])
 }
 
 model Comment {
   id        Int      @id @default(autoincrement())
   createdAt DateTime @default(now())
   updatedAt DateTime @updatedAt
   content   String?
-  post      Post?    @relation(fields: [postId], references: [id])
   postId    Int?
+  post      Post?    @relation(fields: [postId], references: [id])
 }
 
 model Category {

package.json

@@ -1,6 +1,6 @@
 {
   "name": "prisma-rls",
-  "version": "0.5.5",
+  "version": "0.5.6",
   "description": "Prisma client extension for row-level security on any database",
   "license": "MIT",
   "keywords": [

src/extension.ts

@@ -7,7 +7,7 @@ import { AllOperationsArgs, ExtensionOptions, RecursiveContext, RelationMetadata
 import { buildFieldsMap, generateImpossibleWhere, getTransactionClient } from "./utils";
 
 export const createRlsExtension = ({ dmmf, permissionsConfig, context, authorizationError, checkRequiredBelongsTo }: ExtensionOptions) => {
-  const fieldsMap = buildFieldsMap(dmmf);
+  const { fieldsMap, uniqueFields } = buildFieldsMap(dmmf);
 
   if (!authorizationError) {
     authorizationError = new AuthorizationError();
@@ -23,7 +23,14 @@ export const createRlsExtension = ({ dmmf, permissionsConfig, context, authoriza
             const { model: modelName, operation: operationName, args, query } = allOperationsArgs;
 
             const modelPermissions = permissionsConfig[modelName];
-            const modelResolver = new ModelResolver(permissionsConfig, context, fieldsMap, authorizationError, !!checkRequiredBelongsTo);
+            const modelResolver = new ModelResolver(
+              permissionsConfig,
+              context,
+              fieldsMap,
+              uniqueFields,
+              authorizationError,
+              !!checkRequiredBelongsTo,
+            );
 
             switch (operationName) {
               case "findUnique":

src/logic.ts

@@ -18,6 +18,7 @@ import type {
   PrismaTypeMap,
   RecursiveContext,
   RelationMetadata,
+  UniqueFieldsMap,
 } from "./types";
 import {
   generateImpossibleWhere,
@@ -38,6 +39,7 @@ export class ModelResolver {
     protected permissionsConfig: PermissionsConfig<PrismaTypeMap, unknown>,
     protected context: unknown,
     protected fieldsMap: FieldsMap,
+    protected uniqueFieldsMap: UniqueFieldsMap,
     protected authorizationError: Error,
     protected checkRequiredBelongsTo: boolean,
   ) {}
@@ -62,11 +64,21 @@ export class ModelResolver {
     whereUnique: Record<string, unknown>,
   ) {
     if (!permissionDefinition) {
-      return mergeWhereUnique(this.fieldsMap[modelName], whereUnique, generateImpossibleWhere(this.fieldsMap[modelName]));
+      return mergeWhereUnique(
+        this.fieldsMap[modelName],
+        this.uniqueFieldsMap[modelName],
+        whereUnique,
+        generateImpossibleWhere(this.fieldsMap[modelName]),
+      );
     } else if (permissionDefinition === true) {
       return whereUnique;
     } else {
-      return mergeWhereUnique(this.fieldsMap[modelName], whereUnique, await resolvePermissionDefinition(permissionDefinition, this.context));
+      return mergeWhereUnique(
+        this.fieldsMap[modelName],
+        this.uniqueFieldsMap[modelName],
+        whereUnique,
+        await resolvePermissionDefinition(permissionDefinition, this.context),
+      );
     }
   }
 
@@ -231,6 +243,7 @@ export class ModelResolver {
       const relationModelName = fieldDef.type;
       const relationFields = this.fieldsMap[relationModelName];
       const relationPermissions = this.permissionsConfig[relationModelName];
+      const uniqueFields = this.uniqueFieldsMap[relationModelName];
 
       if (fieldDef.isList) {
         return mapObjectValues(dataValue as ModelCreateNestedManyInput, async ([actionName, actionValue]) => {
@@ -258,7 +271,7 @@ export class ModelResolver {
                   return transformValue(actionValue, async (value) => {
                     return {
                       create: await this.resolveCreate(relationModelName, value.create),
-                      where: mergeWhereUnique(relationFields, value.where, generateImpossibleWhere(relationFields)),
+                      where: mergeWhereUnique(relationFields, uniqueFields, value.where, generateImpossibleWhere(relationFields)),
                     };
                   });
                 } else if (relationPermissions.read !== true) {
@@ -267,7 +280,7 @@ export class ModelResolver {
                   return transformValue(actionValue, async (value) => {
                     return {
                       create: await this.resolveCreate(relationModelName, value.create),
-                      where: mergeWhereUnique(relationFields, value.where, permissionDefinition),
+                      where: mergeWhereUnique(relationFields, uniqueFields, value.where, permissionDefinition),
                     };
                   });
                 } else {
@@ -282,13 +295,13 @@ export class ModelResolver {
             case "connect":
               if (!relationPermissions.read) {
                 return transformValue(actionValue, async (value) => {
-                  return mergeWhereUnique(relationFields, value, generateImpossibleWhere(relationFields));
+                  return mergeWhereUnique(relationFields, uniqueFields, value, generateImpossibleWhere(relationFields));
                 });
               } else if (relationPermissions.read !== true) {
                 const permissionDefinition = await resolvePermissionDefinition(relationPermissions.read, this.context);
 
                 return transformValue(actionValue, async (value) => {
-                  return mergeWhereUnique(relationFields, value, permissionDefinition);
+                  return mergeWhereUnique(relationFields, uniqueFields, value, permissionDefinition);
                 });
               }
               break;
@@ -316,7 +329,7 @@ export class ModelResolver {
                 if (!relationPermissions.read) {
                   return {
                     create: await this.resolveCreate(relationModelName, actionValue.create),
-                    where: mergeWhereUnique(relationFields, actionValue.where, generateImpossibleWhere(relationFields)),
+                    where: mergeWhereUnique(relationFields, uniqueFields, actionValue.where, generateImpossibleWhere(relationFields)),
                   };
                 } else if (relationPermissions.read !== true) {
                   const [create, permissionDefinition] = await Promise.all([
@@ -326,7 +339,7 @@ export class ModelResolver {
 
                   return {
                     create,
-                    where: mergeWhereUnique(relationFields, actionValue.where, permissionDefinition),
+                    where: mergeWhereUnique(relationFields, uniqueFields, actionValue.where, permissionDefinition),
                   };
                 } else {
                   return {
@@ -337,9 +350,14 @@ export class ModelResolver {
               }
             case "connect":
               if (!relationPermissions.read) {
-                return mergeWhereUnique(relationFields, actionValue, generateImpossibleWhere(relationFields));
+                return mergeWhereUnique(relationFields, uniqueFields, actionValue, generateImpossibleWhere(relationFields));
               } else if (relationPermissions.read !== true) {
-                return mergeWhereUnique(relationFields, actionValue, await resolvePermissionDefinition(relationPermissions.read, this.context));
+                return mergeWhereUnique(
+                  relationFields,
+                  uniqueFields,
+                  actionValue,
+                  await resolvePermissionDefinition(relationPermissions.read, this.context),
+                );
               }
               break;
             default:
@@ -362,6 +380,7 @@ export class ModelResolver {
       const relationModelName = fieldDef.type;
       const relationFields = this.fieldsMap[relationModelName];
       const relationPermissions = this.permissionsConfig[relationModelName];
+      const uniqueFields = this.uniqueFieldsMap[relationModelName];
 
       if (fieldDef.isList) {
         return mapObjectValues(dataValue as ModelUpdateNestedManyInput, async ([actionName, actionValue]) => {
@@ -389,7 +408,7 @@ export class ModelResolver {
                   return transformValue(actionValue, async (value) => {
                     return {
                       create: await this.resolveCreate(relationModelName, value.create),
-                      where: mergeWhereUnique(relationFields, value.where, generateImpossibleWhere(relationFields)),
+                      where: mergeWhereUnique(relationFields, uniqueFields, value.where, generateImpossibleWhere(relationFields)),
                     };
                   });
                 } else if (relationPermissions.read !== true) {
@@ -398,7 +417,7 @@ export class ModelResolver {
                   return transformValue(actionValue, async (value) => {
                     return {
                       create: await this.resolveCreate(relationModelName, value.create),
-                      where: mergeWhereUnique(relationFields, value.where, permissionDefinition),
+                      where: mergeWhereUnique(relationFields, uniqueFields, value.where, permissionDefinition),
                     };
                   });
                 } else {
@@ -415,13 +434,13 @@ export class ModelResolver {
             case "disconnect":
               if (!relationPermissions.read) {
                 return transformValue(actionValue, async (value) => {
-                  return mergeWhereUnique(relationFields, value, generateImpossibleWhere(relationFields));
+                  return mergeWhereUnique(relationFields, uniqueFields, value, generateImpossibleWhere(relationFields));
                 });
               } else if (relationPermissions.read !== true) {
                 const permissionDefinition = await resolvePermissionDefinition(relationPermissions.read, this.context);
 
                 return transformValue(actionValue, async (value) => {
-                  return mergeWhereUnique(relationFields, value, permissionDefinition);
+                  return mergeWhereUnique(relationFields, uniqueFields, value, permissionDefinition);
                 });
               }
               break;
@@ -434,7 +453,7 @@ export class ModelResolver {
                 return transformValue(actionValue, async (value) => {
                   return {
                     data: await this.resolveUpdate(relationModelName, value.data),
-                    where: mergeWhereUnique(relationFields, value.where, permissionDefinition),
+                    where: mergeWhereUnique(relationFields, uniqueFields, value.where, permissionDefinition),
                   };
                 });
               } else {
@@ -474,7 +493,7 @@ export class ModelResolver {
                   return {
                     create,
                     update,
-                    where: mergeWhereUnique(relationFields, value.where, permissionDefinition),
+                    where: mergeWhereUnique(relationFields, uniqueFields, value.where, permissionDefinition),
                   };
                 });
               } else {
@@ -494,7 +513,7 @@ export class ModelResolver {
                 const permissionDefinition = await resolvePermissionDefinition(relationPermissions.delete, this.context);
 
                 return transformValue(actionValue, async (value) => {
-                  return mergeWhereUnique(relationFields, value, permissionDefinition);
+                  return mergeWhereUnique(relationFields, uniqueFields, value, permissionDefinition);
                 });
               }
               break;
@@ -533,7 +552,7 @@ export class ModelResolver {
                 if (!relationPermissions.read) {
                   return {
                     create: await this.resolveCreate(relationModelName, actionValue.create),
-                    where: mergeWhereUnique(relationFields, actionValue.where, generateImpossibleWhere(relationFields)),
+                    where: mergeWhereUnique(relationFields, uniqueFields, actionValue.where, generateImpossibleWhere(relationFields)),
                   };
                 } else if (relationPermissions.read !== true) {
                   const [create, permissionDefinition] = await Promise.all([
@@ -543,7 +562,7 @@ export class ModelResolver {
 
                   return {
                     create,
-                    where: mergeWhereUnique(relationFields, actionValue.where, permissionDefinition),
+                    where: mergeWhereUnique(relationFields, uniqueFields, actionValue.where, permissionDefinition),
                   };
                 } else {
                   return {
@@ -554,9 +573,14 @@ export class ModelResolver {
               }
             case "connect":
               if (!relationPermissions.read) {
-                return mergeWhereUnique(relationFields, actionValue, generateImpossibleWhere(relationFields));
+                return mergeWhereUnique(relationFields, uniqueFields, actionValue, generateImpossibleWhere(relationFields));
               } else if (relationPermissions.read !== true) {
-                return mergeWhereUnique(relationFields, actionValue, await resolvePermissionDefinition(relationPermissions.read, this.context));
+                return mergeWhereUnique(
+                  relationFields,
+                  uniqueFields,
+                  actionValue,
+                  await resolvePermissionDefinition(relationPermissions.read, this.context),
+                );
               }
               break;
             case "disconnect":
@@ -596,7 +620,7 @@ export class ModelResolver {
 
                   return {
                     data,
-                    where: mergeWhereUnique(relationFields, actionValue.where, permissionDefinition),
+                    where: mergeWhereUnique(relationFields, uniqueFields, actionValue.where, permissionDefinition),
                   };
                 }
               } else {
@@ -631,7 +655,7 @@ export class ModelResolver {
                   return {
                     create,
                     update,
-                    where: mergeWhereUnique(relationFields, actionValue.where, permissionDefinition),
+                    where: mergeWhereUnique(relationFields, uniqueFields, actionValue.where, permissionDefinition),
                   };
                 }
               } else {

src/types.ts

@@ -13,6 +13,7 @@ export type DMMF = ReadonlyDeep<{
         isId: boolean;
         type: string;
       }[];
+      uniqueFields: string[][];
     }[];
   };
 }>;
@@ -77,6 +78,8 @@ export type AllOperationsArgs = { model: PrismaModelName<PrismaTypeMap> } & (
 
 export type FieldsMap = Record<string, Record<string, DMMFField>>;
 
+export type UniqueFieldsMap = Record<string, string[]>;
+
 export type RelationMetadata = {
   type: "requiredBelongsTo";
   path: string;

src/utils.ts

@@ -1,18 +1,21 @@
 import type { Prisma, PrismaClientExtends } from "@prisma/client/extension";
 
-import { AllOperationsArgs, DMMF, DMMFField, FieldsMap, ObjectEntry } from "./types";
+import { AllOperationsArgs, DMMF, DMMFField, FieldsMap, ObjectEntry, UniqueFieldsMap } from "./types";
 
-export function buildFieldsMap(dmmf: DMMF): FieldsMap {
+export function buildFieldsMap(dmmf: DMMF): { fieldsMap: FieldsMap; uniqueFields: UniqueFieldsMap } {
   const fieldsMap: FieldsMap = {};
+  const uniqueFields: UniqueFieldsMap = {};
 
   for (const model of dmmf.datamodel.models) {
     fieldsMap[model.name] = {};
+    uniqueFields[model.name] = model.uniqueFields.map((uniqueField) => uniqueField.join("_"));
+
     for (const field of model.fields) {
       fieldsMap[model.name][field.name] = field;
     }
   }
 
-  return fieldsMap;
+  return { fieldsMap, uniqueFields };
 }
 
 export function getTransactionClient(prismaClient: PrismaClientExtends, allOperationsArgs: AllOperationsArgs): Prisma.TransactionClient {
@@ -81,6 +84,7 @@ export function mergeWhere(first: Record<string, unknown> | undefined, second: R
 
 export function mergeWhereUnique(
   fields: Record<string, DMMFField>,
+  uniqueFields: string[],
   firstUnique: Record<string, unknown>,
   second: Record<string, unknown>,
 ): Record<string, unknown> {
@@ -90,7 +94,7 @@ export function mergeWhereUnique(
   for (const [fieldName, fieldValue] of Object.entries(firstUnique)) {
     const fieldDef = fields[fieldName];
 
-    if (isUniqueField(fieldDef)) {
+    if (uniqueFields.includes(fieldName) || isUniqueField(fieldDef)) {
       unique[fieldName] = fieldValue;
     } else {
       rest[fieldName] = fieldValue;

tests/read.test.ts

@@ -21,6 +21,12 @@ describe("model reading", () => {
       const user = db.user.findUnique({ where: { id: 1 } });
       await expect(user).resolves.toEqual(null);
     });
+
+    test("if read is where with compound unique it return filtered result", async () => {
+      const db = resolveDb({ Post: { read: { id: { equals: 1 } } } });
+      const post = db.post.findUnique({ where: { title_categoryId: { title: "Quick bites", categoryId: 1 } } });
+      await expect(post).resolves.toMatchObject({ id: 1 });
+    });
   });
 
   describe("find unique or throw", () => {