fix(postgrest): reject excess properties in insert, update, and upsert

The generic signatures `<Row extends Base>(values: Row)` bypass
TypeScript's excess property checking, allowing extra keys that
cause runtime Postgres errors. This adds a RejectExcessProperties
utility type that maps unknown keys to never, catching them at
compile time.

Fixes #1636

Author: oniani1

packages/core/postgrest-js/src/PostgrestQueryBuilder.ts

@@ -7,6 +7,7 @@ import {
   GenericTable,
   GenericView,
 } from './types/common/common'
+import { RejectExcessProperties } from './types/types'
 
 export default class PostgrestQueryBuilder<
   ClientOptions extends ClientServerOptions,
@@ -919,7 +920,10 @@ export default class PostgrestQueryBuilder<
 
   // TODO(v3): Make `defaultToNull` consistent for both single & bulk inserts.
   insert<Row extends Relation extends { Insert: unknown } ? Relation['Insert'] : never>(
-    values: Row,
+    values: RejectExcessProperties<
+      Relation extends { Insert: unknown } ? Relation['Insert'] : never,
+      Row
+    >,
     options?: {
       count?: 'exact' | 'planned' | 'estimated'
     }
@@ -933,7 +937,10 @@ export default class PostgrestQueryBuilder<
     'POST'
   >
   insert<Row extends Relation extends { Insert: unknown } ? Relation['Insert'] : never>(
-    values: Row[],
+    values: RejectExcessProperties<
+      Relation extends { Insert: unknown } ? Relation['Insert'] : never,
+      Row
+    >[],
     options?: {
       count?: 'exact' | 'planned' | 'estimated'
       defaultToNull?: boolean
@@ -1059,7 +1066,15 @@ export default class PostgrestQueryBuilder<
    * ```
    */
   insert<Row extends Relation extends { Insert: unknown } ? Relation['Insert'] : never>(
-    values: Row | Row[],
+    values:
+      | RejectExcessProperties<
+          Relation extends { Insert: unknown } ? Relation['Insert'] : never,
+          Row
+        >
+      | RejectExcessProperties<
+          Relation extends { Insert: unknown } ? Relation['Insert'] : never,
+          Row
+        >[],
     {
       count,
       defaultToNull = true,
@@ -1107,7 +1122,10 @@ export default class PostgrestQueryBuilder<
 
   // TODO(v3): Make `defaultToNull` consistent for both single & bulk upserts.
   upsert<Row extends Relation extends { Insert: unknown } ? Relation['Insert'] : never>(
-    values: Row,
+    values: RejectExcessProperties<
+      Relation extends { Insert: unknown } ? Relation['Insert'] : never,
+      Row
+    >,
     options?: {
       onConflict?: string
       ignoreDuplicates?: boolean
@@ -1123,7 +1141,10 @@ export default class PostgrestQueryBuilder<
     'POST'
   >
   upsert<Row extends Relation extends { Insert: unknown } ? Relation['Insert'] : never>(
-    values: Row[],
+    values: RejectExcessProperties<
+      Relation extends { Insert: unknown } ? Relation['Insert'] : never,
+      Row
+    >[],
     options?: {
       onConflict?: string
       ignoreDuplicates?: boolean
@@ -1349,7 +1370,15 @@ export default class PostgrestQueryBuilder<
    */
 
   upsert<Row extends Relation extends { Insert: unknown } ? Relation['Insert'] : never>(
-    values: Row | Row[],
+    values:
+      | RejectExcessProperties<
+          Relation extends { Insert: unknown } ? Relation['Insert'] : never,
+          Row
+        >
+      | RejectExcessProperties<
+          Relation extends { Insert: unknown } ? Relation['Insert'] : never,
+          Row
+        >[],
     {
       onConflict,
       ignoreDuplicates = false,
@@ -1542,7 +1571,10 @@ export default class PostgrestQueryBuilder<
    * ```
    */
   update<Row extends Relation extends { Update: unknown } ? Relation['Update'] : never>(
-    values: Row,
+    values: RejectExcessProperties<
+      Relation extends { Update: unknown } ? Relation['Update'] : never,
+      Row
+    >,
     {
       count,
     }: {

packages/core/postgrest-js/src/types/types.ts

@@ -38,6 +38,12 @@ export type DatabaseWithOptions<Database, Options extends ClientServerOptions> =
 // https://twitter.com/mattpocockuk/status/1622730173446557697
 export type Prettify<T> = { [K in keyof T]: T[K] } & {}
 
+// Rejects excess properties that aren't in Base.
+// Works around TypeScript not checking excess properties on generic parameters.
+export type RejectExcessProperties<Base, Row> = Row & {
+  [K in Exclude<keyof Row, keyof Base>]: never
+}
+
 // https://github.com/sindresorhus/type-fest
 export type SimplifyDeep<Type, ExcludeType = never> = ConditionalSimplifyDeep<
   Type,

packages/core/postgrest-js/test/index.test-d.ts

@@ -173,6 +173,20 @@ const postgrestWithOptions = new PostgrestClient<DatabaseWithOptions>(REST_URL)
   postgrest.from('updatable_view').update({ non_updatable_column: 0 })
 }
 
+// reject excess properties on insert, update, and upsert (#1636)
+{
+  // @ts-expect-error No overload matches this call.
+  postgrest.from('users').insert({ username: 'foo', nonexistent: 'bad' })
+}
+{
+  // @ts-expect-error Type 'string' is not assignable to type 'never'.
+  postgrest.from('users').update({ username: 'foo', nonexistent: 'bad' })
+}
+{
+  // @ts-expect-error No overload matches this call.
+  postgrest.from('users').upsert({ username: 'foo', nonexistent: 'bad' })
+}
+
 // spread resource with single column in select query
 {
   const result = await postgrest.from('messages').select('message, ...users(status)').single()