fix(fumadb): validate bulk upsert conflict shapes

Author: aryasaatvik

packages/core/fumadb/src/adapters/drizzle/query.ts

@@ -315,6 +315,10 @@ export function fromDrizzle(
     },
     async upsertMany(table, v) {
       if (v.values.length === 0) return;
+      if (v.target.length === 0) {
+        // oxlint-disable-next-line executor/no-try-catch-or-throw, executor/no-error-constructor -- boundary: adapter rejects invalid upsert shape
+        throw new Error("[FumaDB] upsertMany requires at least one target column.");
+      }
       if (v.update.length === 0) {
         // oxlint-disable-next-line executor/no-try-catch-or-throw, executor/no-error-constructor -- boundary: adapter rejects invalid upsert shape
         throw new Error("[FumaDB] upsertMany requires at least one update column.");
@@ -367,14 +371,18 @@ export function fromDrizzle(
 
       for (let i = 0; i < values.length; i += batchSize) {
         const batch = values.slice(i, i + batchSize);
-        await (db as any)
-          .insert(drizzleTable)
-          .values(batch)
-          .onConflictDoUpdate({
-            target,
-            set,
-            ...(where === undefined ? {} : { where }),
-          });
+        const insert = db.insert(drizzleTable).values(batch) as unknown as {
+          onConflictDoUpdate: (input: {
+            readonly target: typeof target;
+            readonly set: typeof set;
+            readonly where?: typeof where;
+          }) => Promise<unknown>;
+        };
+        await insert.onConflictDoUpdate({
+          target,
+          set,
+          ...(where === undefined ? {} : { where }),
+        });
       }
     },
     async findMany(table, v) {

packages/core/fumadb/src/adapters/memory/index.ts

@@ -175,6 +175,10 @@ export function memoryAdapter(options: MemoryAdapterOptions = {}): FumaDBAdapter
           await this.create(table, v.create);
         },
         async upsertMany(table, v) {
+          if (v.target.length === 0) {
+            // oxlint-disable-next-line executor/no-try-catch-or-throw, executor/no-error-constructor -- boundary: adapter rejects invalid upsert shape
+            throw new Error("[FumaDB] upsertMany requires at least one target column.");
+          }
           if (v.update.length === 0) {
             // oxlint-disable-next-line executor/no-try-catch-or-throw, executor/no-error-constructor -- boundary: adapter rejects invalid upsert shape
             throw new Error("[FumaDB] upsertMany requires at least one update column.");

packages/core/fumadb/src/query/orm/index.ts

@@ -407,6 +407,14 @@ export function toORM<S extends AnySchema>(
     async upsertMany(name, { target, update, values }) {
       const table = toTable(name);
       if (values.length === 0) return;
+      if (target.length === 0) {
+        // oxlint-disable-next-line executor/no-try-catch-or-throw, executor/no-error-constructor -- boundary: public query rejects invalid upsert shape
+        throw new Error("[FumaDB] upsertMany requires at least one target column.");
+      }
+      if (update.length === 0) {
+        // oxlint-disable-next-line executor/no-try-catch-or-throw, executor/no-error-constructor -- boundary: public query rejects invalid upsert shape
+        throw new Error("[FumaDB] upsertMany requires at least one update column.");
+      }
 
       const targetColumns = target.map((columnName) => {
         const column = table.columns[columnName as string];

packages/core/fumadb/src/query/table-policy.test.ts

@@ -482,6 +482,37 @@ describe("FumaDB table policies", () => {
     }),
   );
 
+  it.effect("rejects invalid bulk upsert conflict shapes", () =>
+    useHarness(async (orm) => {
+      await seedTenants(orm);
+      const tenantA = withQueryContext(orm, makeContext(["tenant-a"], "tenant-a"));
+      const values = [
+        {
+          id: "post-a-bulk-upsert",
+          tenantId: "tenant-a",
+          authorId: "author-a",
+          title: "A bulk upsert",
+        },
+      ];
+
+      await expect(
+        tenantA.upsertMany("posts", {
+          target: [],
+          update: ["title"],
+          values,
+        }),
+      ).rejects.toThrow("[FumaDB] upsertMany requires at least one target column.");
+
+      await expect(
+        tenantA.upsertMany("posts", {
+          target: ["id"],
+          update: [],
+          values,
+        }),
+      ).rejects.toThrow("[FumaDB] upsertMany requires at least one update column.");
+    }),
+  );
+
   it.effect("fails closed when a query wrapper does not forward context rebinding", () =>
     useHarness(async (orm) => {
       const wrapped = { ...orm };