mine-prisma-sql-index-risks

Read-only mining codemod that reports possible missing-index risks in JavaScript and TypeScript source.

What It Detects

• Prisma object-literal queries on findMany, findFirst, and findUnique
• Embedded SQL in string literals, template literals, and SQL-tagged or Prisma raw-query templates

The codemod emits warning findings with rule id possible-missing-db-index and does not modify source files.

Prisma Findings

Flags Prisma calls when either condition is present:

• where combined with orderBy
• nested contains inside where

When available, findings include:

• model name
• operation name
• predicate fields from where
• order fields from orderBy
• source location
• a compact query summary

Example:

ts
Copy
await db.user.findMany({
  where: { email: { contains: "@company.com" } },
  orderBy: { createdAt: "desc" },
});

Embedded SQL Findings

Flags embedded SQL when either condition is present:

• WHERE together with ORDER BY
• leading-wildcard LIKE '%...' or ILIKE '%...'

When available, findings include:

• table name from FROM ...
• obvious predicate columns from WHERE
• obvious sort columns from ORDER BY
• whether leading-wildcard matching was detected
• source location

Example:

ts
Copy
await prisma.$queryRaw`
  SELECT id FROM users
  WHERE email ILIKE '%@company.com'
  ORDER BY created_at DESC
`;

Suppressions

The codemod skips obvious test and mock paths:

• __tests__
• test
• tests
• fixtures
• __mocks__
• mocks
• files ending in .test.* or .spec.*

Usage

bash
Copy
# Run the published package
npx codemod mine-prisma-sql-index-risks -t /path/to/repo

# Run the local package
npx codemod workflow run -w . -t /path/to/repo

Development

bash
Copy
pnpm test
pnpm check-types
npx codemod workflow validate -w .

Test Coverage

Fixtures cover:

• Prisma findMany with where and orderBy
• Prisma findFirst with contains
• Prisma findUnique with where and orderBy
• orderBy arrays
• embedded SQL strings with WHERE ... ORDER BY
• embedded SQL strings with leading-wildcard LIKE
• tagged template and Prisma raw-query usage
• suppressed test and mock paths
• no source rewrites for mining-only runs

License

MIT