Allow using auth filters on creation

packages/core/src/interfaces/create-many-options.interface.ts

@@ -0,0 +1,3 @@
+import { CreateOneOptions } from './create-one-options.interface'
+
+export type CreateManyOptions<DTO> = CreateOneOptions<DTO>

packages/core/src/interfaces/create-one-options.interface.ts

@@ -0,0 +1,9 @@
+import { Filter } from './filter.interface'
+
+export interface CreateOneOptions<DTO> {
+  /**
+   * Additional filter applied to the input dto before creation. This could be used to apply an additional filter to ensure
+   * that the entity being created belongs to a particular user.
+   */
+  filter?: Filter<DTO>
+}

packages/core/src/interfaces/index.ts

@@ -2,6 +2,8 @@ export * from './aggregate-options.interface'
 export * from './aggregate-query.interface'
 export * from './aggregate-response.interface'
 export * from './count-options.interface'
+export * from './create-many-options.interface'
+export * from './create-one-options.interface'
 export * from './delete-many-options.interface'
 export * from './delete-many-response.interface'
 export * from './delete-one-options.interface'

packages/core/src/services/assembler-query.service.ts

@@ -5,6 +5,8 @@ import {
   AggregateQuery,
   AggregateResponse,
   CountOptions,
+  CreateManyOptions,
+  CreateOneOptions,
   DeleteManyResponse,
   DeleteOneOptions,
   Filter,
@@ -39,15 +41,15 @@ export class AssemblerQueryService<DTO, Entity, C = DeepPartial<DTO>, CE = DeepP
     )
   }
 
-  public async createMany(items: C[]): Promise<DTO[]> {
+  public async createMany(items: C[], opts?: CreateManyOptions<DTO>): Promise<DTO[]> {
     const { assembler } = this
     const converted = await assembler.convertToCreateEntities(items)
-    return this.assembler.convertToDTOs(await this.queryService.createMany(converted))
+    return this.assembler.convertToDTOs(await this.queryService.createMany(converted, this.convertFilterable(opts)))
   }
 
-  public async createOne(item: C): Promise<DTO> {
+  public async createOne(item: C, opts?: CreateOneOptions<DTO>): Promise<DTO> {
     const c = await this.assembler.convertToCreateEntity(item)
-    return this.assembler.convertToDTO(await this.queryService.createOne(c))
+    return this.assembler.convertToDTO(await this.queryService.createOne(c, this.convertFilterable(opts)))
   }
 
   public async deleteMany(filter: Filter<DTO>): Promise<DeleteManyResponse> {

packages/core/src/services/noop-query.service.ts

@@ -7,6 +7,8 @@ import {
   AggregateQuery,
   AggregateResponse,
   CountOptions,
+  CreateManyOptions,
+  CreateOneOptions,
   DeleteManyOptions,
   DeleteManyResponse,
   DeleteOneOptions,
@@ -43,11 +45,11 @@ export class NoOpQueryService<DTO, C = DeepPartial<DTO>, U = DeepPartial<DTO>> i
     return Promise.reject(new NotImplementedException('addRelations is not implemented'))
   }
 
-  public createMany(items: C[]): Promise<DTO[]> {
+  public createMany(items: C[], opts?: CreateManyOptions<DTO>): Promise<DTO[]> {
     return Promise.reject(new NotImplementedException('createMany is not implemented'))
   }
 
-  public createOne(item: C): Promise<DTO> {
+  public createOne(item: C, opts?: CreateOneOptions<DTO>): Promise<DTO> {
     return Promise.reject(new NotImplementedException('createOne is not implemented'))
   }
 

packages/core/src/services/proxy-query.service.ts

@@ -4,6 +4,8 @@ import {
   AggregateQuery,
   AggregateResponse,
   CountOptions,
+  CreateManyOptions,
+  CreateOneOptions,
   DeleteManyResponse,
   DeleteOneOptions,
   Filter,
@@ -172,12 +174,12 @@ export class ProxyQueryService<DTO, C = DeepPartial<DTO>, U = DeepPartial<DTO>>
     return this.proxied.findRelation(RelationClass, relationName, dto, opts)
   }
 
-  public createMany(items: C[]): Promise<DTO[]> {
-    return this.proxied.createMany(items)
+  public createMany(items: C[], opts?: CreateManyOptions<DTO>): Promise<DTO[]> {
+    return this.proxied.createMany(items, opts)
   }
 
-  public createOne(item: C): Promise<DTO> {
-    return this.proxied.createOne(item)
+  public createOne(item: C, opts?: CreateOneOptions<DTO>): Promise<DTO> {
+    return this.proxied.createOne(item, opts)
   }
 
   public async deleteMany(filter: Filter<DTO>): Promise<DeleteManyResponse> {

packages/core/src/services/query.service.ts

@@ -7,6 +7,8 @@ import {
   AggregateQuery,
   AggregateResponse,
   CountOptions,
+  CreateManyOptions,
+  CreateOneOptions,
   DeleteManyOptions,
   DeleteManyResponse,
   DeleteOneOptions,
@@ -243,17 +245,19 @@ export interface QueryService<DTO, C = DeepPartial<DTO>, U = DeepPartial<DTO>> {
    * Create a single record.
    *
    * @param item - the record to create.
+   * @param opts - Additional opts to apply when creating one entity.
    * @returns the created record.
    */
-  createOne(item: C): Promise<DTO>
+  createOne(item: C, opts?: CreateOneOptions<DTO>): Promise<DTO>
 
   /**
    * Creates a multiple record.
    *
    * @param items - the records to create.
+   * @param opts - Additional opts to apply when creating many entities.
    * @returns a created records.
    */
-  createMany(items: C[]): Promise<DTO[]>
+  createMany(items: C[], opts?: CreateManyOptions<DTO>): Promise<DTO[]>
 
   /**
    * Update one record.

packages/query-graphql/src/resolvers/create.resolver.ts

@@ -134,11 +134,10 @@ export const Creatable =
         @AuthorizerFilter({
           operationGroup: OperationGroup.CREATE,
           many: false
-        }) // eslint-disable-next-line @typescript-eslint/no-unused-vars
+        })
         authorizeFilter?: Filter<DTO>
       ): Promise<DTO> {
-        // Ignore `authorizeFilter` for now but give users the ability to throw an UnauthorizedException
-        const created = await this.service.createOne(input.input.input)
+        const created = await this.service.createOne(input.input.input, { filter: authorizeFilter ?? {} })
         if (enableOneSubscriptions) {
           await this.publishCreatedEvent(created, authorizeFilter)
         }
@@ -159,11 +158,10 @@ export const Creatable =
         @AuthorizerFilter({
           operationGroup: OperationGroup.CREATE,
           many: true
-        }) // eslint-disable-next-line @typescript-eslint/no-unused-vars
+        })
         authorizeFilter?: Filter<DTO>
       ): Promise<DTO[]> {
-        // Ignore `authorizeFilter` for now but give users the ability to throw an UnauthorizedException
-        const created = await this.service.createMany(input.input.input)
+        const created = await this.service.createMany(input.input.input, { filter: authorizeFilter ?? {} })
         if (enableManySubscriptions) {
           await Promise.all(created.map((c) => this.publishCreatedEvent(c, authorizeFilter)))
         }

packages/query-mongoose/src/services/mongoose-query.service.ts

@@ -3,6 +3,8 @@ import { NotFoundException } from '@nestjs/common'
 import {
   AggregateQuery,
   AggregateResponse,
+  applyFilter,
+  CreateOneOptions,
   DeepPartial,
   DeleteManyResponse,
   DeleteOneOptions,
@@ -132,9 +134,13 @@ export class MongooseQueryService<Entity extends Document>
    * const todoItem = await this.service.createOne({title: 'Todo Item', completed: false });
    * ```
    * @param record - The entity to create.
+   * @param opts - Additional options.
    */
-  async createOne(record: DeepPartial<Entity>): Promise<Entity> {
+  async createOne(record: DeepPartial<Entity>, opts?: CreateOneOptions<Entity>): Promise<Entity> {
     this.ensureIdIsNotPresent(record)
+    if (opts?.filter && !applyFilter(record as Entity, opts.filter)) {
+      throw new Error('Entity does not meet creation constraints')
+    }
     return this.Model.create(record)
   }
 
@@ -149,10 +155,11 @@ export class MongooseQueryService<Entity extends Document>
    * ]);
    * ```
    * @param records - The entities to create.
+   * @param opts - Additional options.
    */
-  public async createMany(records: DeepPartial<Entity>[]): Promise<Entity[]> {
+  public async createMany(records: DeepPartial<Entity>[], opts?: CreateOneOptions<Entity>): Promise<Entity[]> {
     records.forEach((r) => this.ensureIdIsNotPresent(r))
-    return this.Model.create(records)
+    return this.Model.create(opts?.filter ? applyFilter(records as Entity[], opts.filter) : records)
   }
 
   /**

packages/query-sequelize/src/services/sequelize-query.service.ts

@@ -2,6 +2,8 @@ import { NotFoundException } from '@nestjs/common'
 import {
   AggregateQuery,
   AggregateResponse,
+  applyFilter,
+  CreateOneOptions,
   DeepPartial,
   DeleteManyResponse,
   DeleteOneOptions,
@@ -129,9 +131,13 @@ export class SequelizeQueryService<Entity extends Model<Entity, Partial<Entity>>
    * const todoItem = await this.service.createOne({title: 'Todo Item', completed: false });
    * ```
    * @param record - The entity to create.
+   * @param opts - Additional options.
    */
-  public async createOne(record: DeepPartial<Entity>): Promise<Entity> {
+  public async createOne(record: DeepPartial<Entity>, opts?: CreateOneOptions<Entity>): Promise<Entity> {
     await this.ensureEntityDoesNotExist(record)
+    if (opts?.filter && !applyFilter(record as Entity, opts.filter)) {
+      throw new Error('Entity does not meet creation constraints')
+    }
     const changedValues = this.getChangedValues(record)
     return this.model.create<Entity>(changedValues as MakeNullishOptional<Entity>)
   }
@@ -147,11 +153,15 @@ export class SequelizeQueryService<Entity extends Model<Entity, Partial<Entity>>
    * ]);
    * ```
    * @param records - The entities to create.
+   * @param opts - Additional options.
    */
-  public async createMany(records: DeepPartial<Entity>[]): Promise<Entity[]> {
+  public async createMany(records: DeepPartial<Entity>[], opts?: CreateOneOptions<Entity>): Promise<Entity[]> {
     await Promise.all(records.map((r) => this.ensureEntityDoesNotExist(r)))
+    const filteredRecords = opts?.filter ? applyFilter(records as Entity[], opts.filter) : records
 
-    return this.model.bulkCreate<Entity>(records.map((r) => this.getChangedValues(r) as MakeNullishOptional<Entity>))
+    return this.model.bulkCreate<Entity>(
+      filteredRecords.map((r) => this.getChangedValues(r as DeepPartial<Entity>) as MakeNullishOptional<Entity>)
+    )
   }
 
   /**

packages/query-typegoose/src/services/typegoose-query-service.ts

@@ -2,6 +2,9 @@ import { NotFoundException } from '@nestjs/common'
 import {
   AggregateQuery,
   AggregateResponse,
+  applyFilter,
+  CreateManyOptions,
+  CreateOneOptions,
   DeepPartial,
   DeleteManyResponse,
   DeleteOneOptions,
@@ -116,9 +119,13 @@ export class TypegooseQueryService<Entity extends Base> extends ReferenceQuerySe
    * const todoItem = await this.service.createOne({title: 'Todo Item', completed: false });
    * ```
    * @param record - The entity to create.
+   * @param opts - Additional options.
    */
-  async createOne(record: DeepPartial<Entity>): Promise<DocumentType<Entity>> {
+  async createOne(record: DeepPartial<Entity>, opts?: CreateOneOptions<Entity>): Promise<DocumentType<Entity>> {
     this.ensureIdIsNotPresent(record)
+    if (opts?.filter && !applyFilter(record as Entity, opts.filter)) {
+      throw new Error('Entity does not meet creation constraints')
+    }
     const doc = await this.Model.create(record)
     return doc
   }
@@ -135,9 +142,9 @@ export class TypegooseQueryService<Entity extends Base> extends ReferenceQuerySe
    * ```
    * @param records - The entities to create.
    */
-  async createMany(records: DeepPartial<Entity>[]): Promise<DocumentType<Entity>[]> {
+  async createMany(records: DeepPartial<Entity>[], opts?: CreateManyOptions<Entity>): Promise<DocumentType<Entity>[]> {
     records.forEach((r) => this.ensureIdIsNotPresent(r))
-    const entities = await this.Model.create(records)
+    const entities = await this.Model.create(opts?.filter ? applyFilter(records as Entity[], opts.filter) : records)
     return entities
   }
 

packages/query-typeorm/src/services/typeorm-query.service.ts

@@ -3,8 +3,10 @@ import {
   AggregateOptions,
   AggregateQuery,
   AggregateResponse,
+  applyFilter,
   Class,
   CountOptions,
+  CreateOneOptions,
   DeepPartial,
   DeleteManyOptions,
   DeleteManyResponse,
@@ -190,12 +192,15 @@ export class TypeOrmQueryService<Entity>
    * const todoItem = await this.service.createOne({title: 'Todo Item', completed: false });
    * ```
    * @param record - The entity to create.
+   * @param opts - Additional options.
    */
-  public async createOne(record: DeepPartial<Entity>): Promise<Entity> {
+  public async createOne(record: DeepPartial<Entity>, opts?: CreateOneOptions<Entity>): Promise<Entity> {
     const entity = await this.ensureIsEntityAndDoesNotExist(record)
 
-    // eslint-disable-next-line @typescript-eslint/ban-ts-comment
-    // @ts-ignore
+    if (opts?.filter && !applyFilter(entity, opts.filter)) {
+      throw new Error('Entity does not meet creation constraints')
+    }
+
     return this.repo.save(entity)
   }
 
@@ -210,12 +215,11 @@ export class TypeOrmQueryService<Entity>
    * ]);
    * ```
    * @param records - The entities to create.
+   * @param opts - Additional options.
    */
-  public async createMany(records: DeepPartial<Entity>[]): Promise<Entity[]> {
+  public async createMany(records: DeepPartial<Entity>[], opts?: CreateOneOptions<Entity>): Promise<Entity[]> {
     const entities = await Promise.all(records.map((r) => this.ensureIsEntityAndDoesNotExist(r)))
-    // eslint-disable-next-line @typescript-eslint/ban-ts-comment
-    // @ts-ignore
-    return this.repo.save(entities)
+    return this.repo.save(opts?.filter ? applyFilter(entities, opts.filter) : entities)
   }
 
   /**