From db6f34e127a8439849b60872007b62038820eada Mon Sep 17 00:00:00 2001
From: 3m1n3nc3 <mygames.ng@gmail.com>
Date: Mon, 19 Oct 2026 06:27:24 +0100
Subject: [PATCH] fix(query-builder): keep every where condition in deletes and
 updates

delete(), update() and updateFrom() rebuilt their where clause through the
Prisma-like schema shape, which only represents comparisons, groups and
negations. Raw, JSON, relation, exists, column-comparison, date/time,
full-text and expression conditions were silently dropped, widening the
write to every row the remaining constraints matched.

Writes now build from the same structured condition reads use. update()
only takes the primary-key path when the whole condition is a primary-key
equality, and combining an unconvertible object where with structured
constraints throws instead of losing one of them.
---
 src/QueryBuilder.ts                   | 223 ++++++++++++++------------
 tests/postgres/kysely-adapter.spec.ts |  66 ++++++++
 2 files changed, 188 insertions(+), 101 deletions(-)

diff --git a/src/QueryBuilder.ts b/src/QueryBuilder.ts
index dbd0170..088b0d6 100644
--- a/src/QueryBuilder.ts
+++ b/src/QueryBuilder.ts
@@ -332,20 +332,13 @@ export class QueryBuilder<TModel, TDelegate extends ModelQuerySchemaLike = Model
   }
 
   /**
-   * Appends a pre-built structured condition, first flushing any Prisma-like
-   * legacy where into the structured representation so the two combine correctly.
+   * Appends a pre-built structured condition.
    *
    * @param boolean
    * @param condition
    * @returns
    */
   private appendStructuredWhere(boolean: 'AND' | 'OR', condition: QueryCondition): this {
-    if (this.legacyWhere) {
-      const existing = this.tryBuildQueryCondition(this.legacyWhere)
-      this.legacyWhere = undefined
-      if (existing) this.queryWhere = existing
-    }
-
     this.appendQueryCondition(boolean, condition)
 
     return this
@@ -1312,6 +1305,15 @@ export class QueryBuilder<TModel, TDelegate extends ModelQuerySchemaLike = Model
       return this
     }
 
+    if (!this.legacyWhere && this.queryWhere && !this.isSchemaWhereRepresentable(this.queryWhere))
+      throw new UnsupportedAdapterFeatureException(
+        'This where clause cannot be combined with the raw, JSON, relation, or expression constraints already on the query.',
+        {
+          operation: 'query.where',
+          model: this.model.name,
+        },
+      )
+
     const existingWhere = this.legacyWhere ?? this.toQuerySchemaWhere(this.queryWhere)
     this.queryWhere = undefined
 
@@ -3626,21 +3628,15 @@ export class QueryBuilder<TModel, TDelegate extends ModelQuerySchemaLike = Model
    * @returns
    */
   public async update(data: ModelUpdateData<TModel, TDelegate>): Promise<TModel> {
-    const where = this.buildWhere()
-    if (!where)
-      throw new QueryConstraintException('Update requires a where clause.', {
-        operation: 'update',
-        model: this.model.name,
-      })
-
-    const directSpec = this.tryBuildUpdateSpec(where, data as QuerySchemaUpdateData<TDelegate>)
+    const condition = this.buildWriteCondition('update', 'Update')
+    const uniqueWhere = this.uniqueWhereFor(condition)
     const adapter = this.requireAdapter()
-    if (
-      !this.isUniqueWhere(where as Record<string, unknown>) &&
-      directSpec &&
-      typeof adapter.updateFirst === 'function'
-    ) {
-      const updated = await adapter.updateFirst(directSpec)
+    if (!uniqueWhere && typeof adapter.updateFirst === 'function') {
+      const updated = await adapter.updateFirst({
+        target: this.buildQueryTarget(),
+        where: condition,
+        values: data as DatabaseRow,
+      })
       if (!updated)
         throw new ModelNotFoundException(
           this.model.name,
@@ -3653,9 +3649,8 @@ export class QueryBuilder<TModel, TDelegate extends ModelQuerySchemaLike = Model
       return this.model.hydrate(updated as Parameters<ModelStatic<TModel, TDelegate>['hydrate']>[0])
     }
 
-    const uniqueWhere = await this.resolveUniqueWhere(where)
     const updated = await this.executeUpdateRow(
-      uniqueWhere!,
+      uniqueWhere ?? (await this.resolveUniqueWhere(condition))!,
       data as QuerySchemaUpdateData<TDelegate>,
     )
 
@@ -3670,14 +3665,9 @@ export class QueryBuilder<TModel, TDelegate extends ModelQuerySchemaLike = Model
    * @returns
    */
   public async updateFrom(data: ModelUpdateData<TModel, TDelegate>): Promise<number> {
-    const where = this.buildWhere()
-    if (!where)
-      throw new QueryConstraintException('Update requires a where clause.', {
-        operation: 'updateFrom',
-        model: this.model.name,
-      })
+    const condition = this.buildWriteCondition('updateFrom', 'Update')
 
-    return await this.executeUpdateManyRows(where, data as QuerySchemaUpdateData<TDelegate>)
+    return await this.executeUpdateManyRows(condition, data as QuerySchemaUpdateData<TDelegate>)
   }
 
   /**
@@ -3834,14 +3824,7 @@ export class QueryBuilder<TModel, TDelegate extends ModelQuerySchemaLike = Model
    * @returns the count of deleted rows (0 when nothing matched)
    */
   public async delete(): Promise<number> {
-    const where = this.buildWhere()
-    if (!where)
-      throw new QueryConstraintException('Delete requires a where clause.', {
-        operation: 'delete',
-        model: this.model.name,
-      })
-
-    return this.executeDeleteManyRows(where)
+    return this.executeDeleteManyRows(this.buildWriteCondition('delete', 'Delete'))
   }
 
   /**
@@ -3912,12 +3895,9 @@ export class QueryBuilder<TModel, TDelegate extends ModelQuerySchemaLike = Model
   }
 
   private tryBuildUpdateManySpec(
-    where: QuerySchemaWhere<TDelegate> | undefined,
+    condition: QueryCondition,
     values: QuerySchemaUpdateData<TDelegate>,
-  ): UpdateManySpec<TModel> | null {
-    const condition = this.tryBuildQueryCondition(where)
-    if (condition === null) return null
-
+  ): UpdateManySpec<TModel> {
     return {
       target: this.buildQueryTarget(),
       where: condition,
@@ -4867,7 +4847,29 @@ export class QueryBuilder<TModel, TDelegate extends ModelQuerySchemaLike = Model
     return plans
   }
 
+  /**
+   * Appends a structured condition, first flushing any Prisma-like legacy
+   * where into the structured representation so that neither is lost.
+   *
+   * @param operator
+   * @param condition
+   */
   private appendQueryCondition(operator: 'AND' | 'OR', condition: QueryCondition): void {
+    if (this.legacyWhere) {
+      const existing = this.tryBuildQueryCondition(this.legacyWhere)
+      if (existing === null)
+        throw new UnsupportedAdapterFeatureException(
+          'This constraint cannot be combined with the where clause already on the query.',
+          {
+            operation: 'query.where',
+            model: this.model.name,
+          },
+        )
+
+      this.legacyWhere = undefined
+      if (existing) this.queryWhere = existing
+    }
+
     if (!this.queryWhere) {
       this.queryWhere = condition
 
@@ -4881,6 +4883,22 @@ export class QueryBuilder<TModel, TDelegate extends ModelQuerySchemaLike = Model
     }
   }
 
+  /**
+   * Whether a condition survives conversion to the Prisma-like where shape;
+   * only comparisons and groups or negations of them do.
+   *
+   * @param condition
+   * @returns
+   */
+  private isSchemaWhereRepresentable(condition: QueryCondition): boolean {
+    if (condition.type === 'comparison') return true
+    if (condition.type === 'group')
+      return condition.conditions.every((entry) => this.isSchemaWhereRepresentable(entry))
+    if (condition.type === 'not') return this.isSchemaWhereRepresentable(condition.condition)
+
+    return false
+  }
+
   private toQuerySchemaWhere(condition?: QueryCondition): QuerySchemaWhere<TDelegate> | undefined {
     if (!condition) return undefined
 
@@ -5519,20 +5537,12 @@ export class QueryBuilder<TModel, TDelegate extends ModelQuerySchemaLike = Model
   }
 
   private async executeUpdateManyRows(
-    where: QuerySchemaWhere<TDelegate> | undefined,
+    condition: QueryCondition,
     values: QuerySchemaUpdateData<TDelegate>,
   ): Promise<number> {
     const adapter = this.requireAdapter()
     const normalizedValues = this.normalizeUpdatePayload(values)
-    const spec = this.tryBuildUpdateManySpec(where, normalizedValues)
-    if (!spec)
-      throw new UnsupportedAdapterFeatureException(
-        'Update-many could not be compiled into an Arkorm update specification.',
-        {
-          operation: 'query.updateMany',
-          model: this.model.name,
-        },
-      )
+    const spec = this.tryBuildUpdateManySpec(condition, normalizedValues)
 
     if (typeof adapter.updateMany === 'function') return await adapter.updateMany(spec)
 
@@ -5557,20 +5567,8 @@ export class QueryBuilder<TModel, TDelegate extends ModelQuerySchemaLike = Model
     return updated
   }
 
-  private async executeDeleteManyRows(
-    where: QuerySchemaWhere<TDelegate> | QuerySchemaUniqueWhere<TDelegate>,
-  ): Promise<number> {
+  private async executeDeleteManyRows(condition: QueryCondition): Promise<number> {
     const adapter = this.requireAdapter()
-    const condition = this.tryBuildQueryCondition(where)
-    if (condition === null)
-      throw new UnsupportedAdapterFeatureException(
-        'Delete could not be compiled into an Arkorm delete specification.',
-        {
-          operation: 'query.delete',
-          model: this.model.name,
-        },
-      )
-
     const spec: DeleteManySpec<TModel> = {
       target: this.buildQueryTarget(),
       where: condition,
@@ -5599,6 +5597,57 @@ export class QueryBuilder<TModel, TDelegate extends ModelQuerySchemaLike = Model
     return deleted
   }
 
+  /**
+   * The complete where condition for a write, built the same way reads build
+   * theirs so that every constraint (raw, JSON, relation, expression, and the
+   * rest) narrows the write. A write without constraints is refused.
+   *
+   * @param operation
+   * @param label
+   * @returns
+   */
+  private buildWriteCondition(operation: string, label: string): QueryCondition {
+    const condition = this.buildQueryWhereCondition()
+
+    if (condition === null)
+      throw new UnsupportedAdapterFeatureException(
+        `${label} could not be compiled into an Arkorm ${label.toLowerCase()} specification.`,
+        {
+          operation: `query.${operation}`,
+          model: this.model.name,
+        },
+      )
+
+    if (!condition)
+      throw new QueryConstraintException(`${label} requires a where clause.`, {
+        operation,
+        model: this.model.name,
+      })
+
+    return condition
+  }
+
+  /**
+   * The primary-key lookup a condition amounts to, when it is nothing more
+   * than an equality on the primary key.
+   *
+   * @param condition
+   * @returns
+   */
+  private uniqueWhereFor(condition: QueryCondition): QuerySchemaUniqueWhere<TDelegate> | null {
+    const primaryKey = this.model.getPrimaryKey()
+
+    if (
+      condition.type !== 'comparison' ||
+      condition.column !== primaryKey ||
+      condition.operator !== '=' ||
+      condition.value == null
+    )
+      return null
+
+    return { [primaryKey]: condition.value } as unknown as QuerySchemaUniqueWhere<TDelegate>
+  }
+
   /**
    * Builds the where clause for the query, taking into account soft delete
    * settings if applicable.
@@ -5631,28 +5680,15 @@ export class QueryBuilder<TModel, TDelegate extends ModelQuerySchemaLike = Model
   /**
    * Resolves a unique where clause for update and delete operations.
    *
-   * @param where
+   * @param condition
    * @returns
    */
   private async resolveUniqueWhere(
-    where: QuerySchemaWhere<TDelegate>,
+    condition: QueryCondition,
     failIfMissing = true,
   ): Promise<QuerySchemaUniqueWhere<TDelegate> | null> {
-    if (this.isUniqueWhere(where as Record<string, unknown>))
-      return where as unknown as QuerySchemaUniqueWhere<TDelegate>
-
-    const condition = this.tryBuildQueryCondition(where)
-    if (!condition)
-      throw new UniqueConstraintResolutionException(
-        'Unable to resolve a unique identifier for update/delete operation from the current query shape.',
-        {
-          operation: 'resolveUniqueWhere',
-          model: this.model.name,
-          meta: {
-            where: where as Record<string, unknown>,
-          },
-        },
-      )
+    const unique = this.uniqueWhereFor(condition)
+    if (unique) return unique
 
     const row = (await this.requireAdapter().selectOne({
       target: this.buildQueryTarget(),
@@ -5670,7 +5706,7 @@ export class QueryBuilder<TModel, TDelegate extends ModelQuerySchemaLike = Model
               {
                 operation: 'resolveUniqueWhere',
                 meta: {
-                  where: where as Record<string, unknown>,
+                  condition,
                 },
               },
             )
@@ -5686,7 +5722,7 @@ export class QueryBuilder<TModel, TDelegate extends ModelQuerySchemaLike = Model
           operation: 'resolveUniqueWhere',
           model: this.model.name,
           meta: {
-            where: where as Record<string, unknown>,
+            condition,
           },
         },
       )
@@ -5694,21 +5730,6 @@ export class QueryBuilder<TModel, TDelegate extends ModelQuerySchemaLike = Model
     return { [primaryKey]: row[primaryKey] } as unknown as QuerySchemaUniqueWhere<TDelegate>
   }
 
-  /**
-   * Checks if the provided where clause is already a unique
-   * identifier (i.e., contains only an 'id' field).
-   *
-   * @param where
-   * @returns
-   */
-  private isUniqueWhere(where: Record<string, unknown>): boolean {
-    const primaryKey = this.model.getPrimaryKey()
-
-    return (
-      Object.keys(where).length === 1 && Object.prototype.hasOwnProperty.call(where, primaryKey)
-    )
-  }
-
   private shuffleRows<TRow>(rows: TRow[]): TRow[] {
     const shuffled = [...rows]
 
diff --git a/tests/postgres/kysely-adapter.spec.ts b/tests/postgres/kysely-adapter.spec.ts
index ffb6a9f..20fd6d7 100644
--- a/tests/postgres/kysely-adapter.spec.ts
+++ b/tests/postgres/kysely-adapter.spec.ts
@@ -380,6 +380,72 @@ describe('PostgreSQL Kysely adapter', () => {
     expect(normalizedSql).toContain('LOWER("email") = $1 OR LOWER("email") LIKE $2')
   })
 
+  it('keeps raw where clauses when deleting', async () => {
+    setPostgresModelAdapter(kyselyAdapter)
+
+    const deleted = await DbUser.query()
+      .where({ email: { contains: '@example.com' } })
+      .whereRaw('LOWER("email") = ?', ['jane@example.com'])
+      .delete()
+
+    expect(deleted).toBe(1)
+    const remaining = await DbUser.query().orderBy({ id: 'asc' }).get()
+    expect(remaining.all().map((user) => user.getAttribute('email'))).toEqual(['john@example.com'])
+  })
+
+  it('keeps raw where clauses when updating every match', async () => {
+    setPostgresModelAdapter(kyselyAdapter)
+
+    const updated = await DbUser.query()
+      .where({ email: { contains: '@example.com' } })
+      .whereRaw('LOWER("email") = ?', ['jane@example.com'])
+      .updateFrom({ name: 'Renamed' })
+
+    expect(updated).toBe(1)
+    const users = await DbUser.query().orderBy({ id: 'asc' }).get()
+    expect(users.all().map((user) => user.getAttribute('name'))).toEqual(['Renamed', 'John'])
+  })
+
+  it('keeps raw where clauses when updating the first match', async () => {
+    setPostgresModelAdapter(kyselyAdapter)
+
+    const updated = await DbUser.query()
+      .where({ email: { contains: '@example.com' } })
+      .whereRaw('LOWER("email") = ?', ['john@example.com'])
+      .update({ name: 'Renamed' })
+
+    expect(updated.getAttribute('email')).toBe('john@example.com')
+    const users = await DbUser.query().orderBy({ id: 'asc' }).get()
+    expect(users.all().map((user) => user.getAttribute('name'))).toEqual(['Jane', 'Renamed'])
+  })
+
+  it('keeps raw where clauses when updating by primary key', async () => {
+    setPostgresModelAdapter(kyselyAdapter)
+    const jane = await DbUser.query().where({ email: 'jane@example.com' }).firstOrFail()
+
+    await expect(
+      DbUser.query()
+        .where({ id: jane.getAttribute('id') })
+        .whereRaw('1 = 0')
+        .update({ name: 'Renamed' }),
+    ).rejects.toThrow('Record not found')
+
+    const users = await DbUser.query().orderBy({ id: 'asc' }).get()
+    expect(users.all().map((user) => user.getAttribute('name'))).toEqual(['Jane', 'John'])
+  })
+
+  it('refuses to drop constraints that cannot be combined', () => {
+    setPostgresModelAdapter(kyselyAdapter)
+    const unconvertible = { email: { mode: 'insensitive' } } as never
+
+    expect(() => DbUser.query().whereRaw('1 = 1').where(unconvertible)).toThrow(
+      'cannot be combined',
+    )
+    expect(() => DbUser.query().where(unconvertible).whereRaw('1 = 1')).toThrow(
+      'cannot be combined',
+    )
+  })
+
   it('compiles a where callback into a parenthesized group', () => {
     setPostgresModelAdapter(kyselyAdapter)