Review this generated router for trust-boundary, result, and resource-use failures.
Let an administrator update one user profile and fetch a bounded audit page.
TypeScript
import { z } from "zod";
import { router, publicProcedure } from "../trpc";
export const userRouter = router({
update: publicProcedure
.input(z.object({
userId: z.string(),
name: z.string(),
role: z.string(),
}))
.mutation(async ({ ctx, input }) => {
const user = await ctx.db.user.findUnique({ where: { id: input.userId } });
if (!user) throw new Error("missing user");
await ctx.db.user.update({
where: { id: user.id },
data: { name: input.name, role: input.role },
});
return ctx.db.user.findMany();
}),
audit: publicProcedure
.input(z.object({ limit: z.number().optional() }))
.query(async ({ ctx, input }) => {
const rows = await ctx.db.audit.findMany();
return rows.slice(0, input.limit ?? rows.length);
}),
});
generated code is illustrative, not from any one model