Build One Guarded Prisma Endpoint, Then Break It Five Ways

A single Prisma endpoint can serve as the foundation for testing its robustness. By purposefully breaking the endpoint in five distinct ways, each altering different aspects of the code, developers can gain valuable insights into potential vulnerabilities. The examples utilize the prisma-guard 1.33.0 library, alongside Prisma version 6.19.3 and Zod 4.4.3, ensuring consistent runtime behavior.

To begin, a simple tenant model is defined, featuring a Nursery relationship and a Plant child model. The generated router requires an extended Prisma client and trusted request context, which includes the authenticated tenant ID. Although authentication is handled by the application code, the tenant ID is extracted from the authenticated session.

The focus then shifts to defining a public read contract. In the guard shape, true indicates that the server chooses the value, while false suggests the client selects it. The `force()` function is used to enforce specific data types, such as converting a Boolean to true.

The `publicPlants` contract specifies various criteria, including case-insensitive filtering based on the plant name and an enforced publication state. These constraints help shape the query results and ensure consistent data retrieval.

The router is configured to select the public variant by default, ensuring that only authorized data is exposed. Tenant scope is maintained separately from the public shape, allowing for fine-grained control over data access.

To demonstrate the endpoint's resilience, five targeted breaks are introduced. Each break alters a specific aspect of the code, forcing the developer to identify and address the underlying issues.

The first break involves forcing a field instead of its operator. This change causes the shape construction to fail, as the where field expects an operator object rather than a forced value. By correcting the syntax, the endpoint can be restored to a functional state.

The second break introduces a server-owned modifier from the client. The `contains` operator is pinned to "insensitive," while the `mode` field is left open for client specification. If a frontend sends the `mode` value regardless, validation fails, indicating a disagreement in value ownership. The endpoint's case-insensitive contract remains intact, as the server appends the necessary modifier.

The third break focuses on forced predicates inside relation filters. When a forced value is provided within a negative relation filter, such as `none` or `isNot`, shape construction fails. This error highlights the importance of carefully considering the placement of forced conditions within the query structure.

The fourth break involves forced fields inside a nested include. When a forced field is specified within an include, validation errors occur. This break emphasizes the need to classify the position of forced fields and determine whether the client should omit them or if conflicting values will be discarded.

The final break targets forced fields in mutation data. Similar to the previous break, forced fields within mutation data can lead to validation errors. Understanding the distinct positions where forced fields can be inserted helps developers properly handle these scenarios and maintain the integrity of the endpoint.

By systematically breaking the endpoint in these targeted ways, developers can uncover potential weaknesses and refine their testing strategies. The examples provided demonstrate the importance of understanding the different aspects of Prisma and guard extension, as well as the implications of forced versus unforced values. Through this process, developers can ensure that their endpoints are robust, secure, and capable of handling various data scenarios effectively.