@cerebruminc/yates 3.3.2-beta.dangerous.6e79492 → 3.3.2-beta.dangerous.8bebbaf

package/dist/index.js

@@ -177,11 +177,11 @@ var createClient = function (prisma, getContext, options) {
         query: {
             $allModels: {
                 $allOperations: function (params) {
+                    var _a;
                     return __awaiter(this, void 0, void 0, function () {
-                        var model, args, query, operation, ctx, role, context, pgRole, _a, _b, k, _c, _d, v, queryResults, e_1;
-                        var e_2, _e, e_3, _f;
+                        var model, args, query, operation, ctx, role, context, pgRole, _b, _c, k, _d, _e, v, queryResults, e_1;
+                        var e_2, _f, e_3, _g;
                         var _this = this;
-                        var _g;
                         return __generator(this, function (_h) {
                             switch (_h.label) {
                                 case 0:
@@ -201,8 +201,8 @@ var createClient = function (prisma, getContext, options) {
                                     pgRole = (0, exports.createRoleName)(role);
                                     if (context) {
                                         try {
-                                            for (_a = __values(Object.keys(context)), _b = _a.next(); !_b.done; _b = _a.next()) {
-                                                k = _b.value;
+                                            for (_b = __values(Object.keys(context)), _c = _b.next(); !_c.done; _c = _b.next()) {
+                                                k = _c.value;
                                                 if (!k.match(/^[a-z_\.]+$/)) {
                                                     throw new Error("Context variable \"".concat(k, "\" contains invalid characters. Context variables must only contain lowercase letters, numbers, periods and underscores."));
                                                 }
@@ -213,8 +213,8 @@ var createClient = function (prisma, getContext, options) {
                                                 }
                                                 if (Array.isArray(context[k])) {
                                                     try {
-                                                        for (_c = (e_3 = void 0, __values(context[k])), _d = _c.next(); !_d.done; _d = _c.next()) {
-                                                            v = _d.value;
+                                                        for (_d = (e_3 = void 0, __values(context[k])), _e = _d.next(); !_e.done; _e = _d.next()) {
+                                                            v = _e.value;
                                                             if (typeof v !== "string") {
                                                                 throw new Error("Context variable \"".concat(k, "\" must be an array of strings. Got ").concat(typeof v));
                                                             }
@@ -223,7 +223,7 @@ var createClient = function (prisma, getContext, options) {
                                                     catch (e_3_1) { e_3 = { error: e_3_1 }; }
                                                     finally {
                                                         try {
-                                                            if (_d && !_d.done && (_f = _c.return)) _f.call(_c);
+                                                            if (_e && !_e.done && (_g = _d.return)) _g.call(_d);
                                                         }
                                                         finally { if (e_3) throw e_3.error; }
                                                     }
@@ -235,7 +235,7 @@ var createClient = function (prisma, getContext, options) {
                                         catch (e_2_1) { e_2 = { error: e_2_1 }; }
                                         finally {
                                             try {
-                                                if (_b && !_b.done && (_e = _a.return)) _e.call(_a);
+                                                if (_c && !_c.done && (_f = _b.return)) _f.call(_b);
                                             }
                                             finally { if (e_2) throw e_2.error; }
                                         }
@@ -307,7 +307,7 @@ var createClient = function (prisma, getContext, options) {
                                 case 3:
                                     e_1 = _h.sent();
                                     // Normalize RLS errors to make them a bit more readable.
-                                    if ((_g = e_1.message) === null || _g === void 0 ? void 0 : _g.includes("new row violates row-level security policy for table")) {
+                                    if ((_a = e_1.message) === null || _a === void 0 ? void 0 : _a.includes("new row violates row-level security policy for table")) {
                                         throw new Error("You do not have permission to perform this action: ".concat(model, ".").concat(operation, "(...)"));
                                     }
                                     throw e_1;
@@ -322,266 +322,315 @@ var createClient = function (prisma, getContext, options) {
     return client;
 };
 exports.createClient = createClient;
-var setRLS = function (prisma, table, roleName, operation, rawExpression) { return __awaiter(void 0, void 0, void 0, function () {
-    var expression, policyName, rows;
-    return __generator(this, function (_a) {
-        switch (_a.label) {
+var setRLS = function (prisma, 
+// biome-ignore lint/suspicious/noExplicitAny: TODO fix this, by providing the correct type for the catalog
+policies, table, roleName, operation, rawExpression) { return __awaiter(void 0, void 0, void 0, function () {
+    var expression, policyName, rows, normalizedExpression, normalizedQual;
+    var _a, _b, _c, _d;
+    return __generator(this, function (_e) {
+        switch (_e.label) {
             case 0:
                 debug("Calculating RLS expression from", rawExpression);
                 return [4 /*yield*/, (0, expressions_1.expressionToSQL)(rawExpression, table)];
             case 1:
-                expression = _a.sent();
+                expression = _e.sent();
                 policyName = roleName;
-                return [4 /*yield*/, prisma.$queryRawUnsafe("\n\t\tselect * from pg_catalog.pg_policies where tablename = '".concat(table, "' AND policyname = '").concat(policyName, "';\n\t"))];
-            case 2:
-                rows = _a.sent();
+                rows = policies.filter(function (row) { return row.tablename === table && row.policyname === policyName; });
                 debug("Creating RLS policy", policyName);
                 debug("On table", table);
                 debug("For operation", operation);
                 debug("To role", roleName);
                 debug("With expression", expression);
-                if (!(rows.length === 0)) return [3 /*break*/, 7];
-                if (!(operation === "INSERT")) return [3 /*break*/, 4];
+                console.log(expression);
+                normalizedExpression = expression === "true"
+                    ? expression
+                    : "(".concat(expression.replace(/(\r\n|\n|\r)/gm, ""), ")");
+                normalizedQual = operation === "INSERT"
+                    ? (_b = (_a = rows === null || rows === void 0 ? void 0 : rows[0]) === null || _a === void 0 ? void 0 : _a.with_check) === null || _b === void 0 ? void 0 : _b.replace(/(\r\n|\n|\r)/gm, "")
+                    : (_d = (_c = rows === null || rows === void 0 ? void 0 : rows[0]) === null || _c === void 0 ? void 0 : _c.qual) === null || _d === void 0 ? void 0 : _d.replace(/(\r\n|\n|\r)/gm, "");
+                if (!(rows.length === 0)) return [3 /*break*/, 6];
+                if (!(operation === "INSERT")) return [3 /*break*/, 3];
                 return [4 /*yield*/, prisma.$queryRawUnsafe("\n        CREATE POLICY ".concat(policyName, " ON \"public\".\"").concat(table, "\" FOR ").concat(operation, " TO ").concat(roleName, " WITH CHECK (").concat(expression, ");\n      "))];
-            case 3:
-                _a.sent();
-                return [3 /*break*/, 6];
-            case 4: return [4 /*yield*/, prisma.$queryRawUnsafe("\n        CREATE POLICY ".concat(policyName, " ON \"public\".\"").concat(table, "\" FOR ").concat(operation, " TO ").concat(roleName, " USING (").concat(expression, ");\n      "))];
-            case 5:
-                _a.sent();
-                _a.label = 6;
-            case 6: return [3 /*break*/, 11];
-            case 7:
-                if (!(rows[0].qual !== expression)) return [3 /*break*/, 11];
-                if (!(operation === "INSERT")) return [3 /*break*/, 9];
+            case 2:
+                _e.sent();
+                return [3 /*break*/, 5];
+            case 3: return [4 /*yield*/, prisma.$queryRawUnsafe("\n        CREATE POLICY ".concat(policyName, " ON \"public\".\"").concat(table, "\" FOR ").concat(operation, " TO ").concat(roleName, " USING (").concat(expression, ");\n      "))];
+            case 4:
+                _e.sent();
+                _e.label = 5;
+            case 5: return [3 /*break*/, 10];
+            case 6:
+                if (!(normalizedQual !== normalizedExpression)) return [3 /*break*/, 10];
+                console.count("ALTERING RLS POLICY");
+                console.log({ operation: operation });
+                console.log("ROW QUAL", normalizedQual);
+                console.log("NORMALIZED", normalizedExpression);
+                console.log("\n\n");
+                if (!(operation === "INSERT")) return [3 /*break*/, 8];
                 return [4 /*yield*/, prisma.$queryRawUnsafe("\n        ALTER POLICY ".concat(policyName, " ON \"public\".\"").concat(table, "\" TO ").concat(roleName, " WITH CHECK (").concat(expression, ");\n      "))];
-            case 8:
-                _a.sent();
-                return [3 /*break*/, 11];
-            case 9: return [4 /*yield*/, prisma.$queryRawUnsafe("\n        ALTER POLICY ".concat(policyName, " ON \"public\".\"").concat(table, "\" TO ").concat(roleName, " USING (").concat(expression, ");\n      "))];
-            case 10:
-                _a.sent();
-                _a.label = 11;
-            case 11: return [2 /*return*/];
+            case 7:
+                _e.sent();
+                return [3 /*break*/, 10];
+            case 8: return [4 /*yield*/, prisma.$queryRawUnsafe("\n        ALTER POLICY ".concat(policyName, " ON \"public\".\"").concat(table, "\" TO ").concat(roleName, " USING (").concat(expression, ");\n      "))];
+            case 9:
+                _e.sent();
+                _e.label = 10;
+            case 10: return [2 /*return*/];
         }
     });
 }); };
-var createRoles = function (_a) { return __awaiter(void 0, [_a], void 0, function (_b) {
-    var abilities, runtimeDataModel, models, diff, models_1, models_1_1, model, ability, operation, roles, _c, _d, _e, _i, model, table, _f, _g, _h, _j, slug, ability, roleName, _loop_1, _k, _l, _m, _o, key;
-    var e_5, _p;
-    var _q;
-    var prisma = _b.prisma, customAbilities = _b.customAbilities, getRoles = _b.getRoles;
-    return __generator(this, function (_r) {
-        switch (_r.label) {
-            case 0:
-                abilities = {};
-                runtimeDataModel = prisma
-                    ._runtimeDataModel;
-                models = Object.keys(runtimeDataModel.models).map(function (m) { return runtimeDataModel.models[m].dbName || m; });
-                if (customAbilities) {
-                    diff = (0, difference_1.default)(Object.keys(customAbilities), models);
-                    if (diff.length) {
-                        throw new Error("Invalid models in custom abilities: ".concat(diff.join(", ")));
+var createRoles = function (_a) {
+    var prisma = _a.prisma, customAbilities = _a.customAbilities, getRoles = _a.getRoles;
+    return __awaiter(void 0, void 0, void 0, function () {
+        var abilities, runtimeDataModel, models, diff, models_1, models_1_1, model, ability, operation, roles, pgRoles, pgPolicies, _b, _c, _d, _i, model, table, _loop_1, _e, _f, _g, _h, slug, _loop_2, _j, _k, _l, _m, key;
+        var e_5, _o;
+        var _p;
+        return __generator(this, function (_q) {
+            switch (_q.label) {
+                case 0:
+                    abilities = {};
+                    runtimeDataModel = prisma
+                        ._runtimeDataModel;
+                    models = Object.keys(runtimeDataModel.models).map(function (m) { return runtimeDataModel.models[m].dbName || m; });
+                    if (customAbilities) {
+                        diff = (0, difference_1.default)(Object.keys(customAbilities), models);
+                        if (diff.length) {
+                            throw new Error("Invalid models in custom abilities: ".concat(diff.join(", ")));
+                        }
                     }
-                }
-                try {
-                    for (models_1 = __values(models), models_1_1 = models_1.next(); !models_1_1.done; models_1_1 = models_1.next()) {
-                        model = models_1_1.value;
-                        abilities[model] = {
-                            create: {
-                                description: "Create ".concat(model),
-                                expression: "true",
-                                operation: "INSERT",
-                                // biome-ignore lint/suspicious/noExplicitAny: TODO fix this
-                                model: model,
-                                slug: "create",
-                            },
-                            read: {
-                                description: "Read ".concat(model),
-                                expression: "true",
-                                operation: "SELECT",
-                                // biome-ignore lint/suspicious/noExplicitAny: TODO fix this
-                                model: model,
-                                slug: "read",
-                            },
-                            update: {
-                                description: "Update ".concat(model),
-                                expression: "true",
-                                operation: "UPDATE",
-                                // biome-ignore lint/suspicious/noExplicitAny: TODO fix this
-                                model: model,
-                                slug: "update",
-                            },
-                            delete: {
-                                description: "Delete ".concat(model),
-                                expression: "true",
-                                operation: "DELETE",
-                                // biome-ignore lint/suspicious/noExplicitAny: TODO fix this
-                                model: model,
-                                slug: "delete",
-                            },
-                        };
-                        if (customAbilities === null || customAbilities === void 0 ? void 0 : customAbilities[model]) {
-                            for (ability in customAbilities[model]) {
-                                operation = 
-                                // biome-ignore lint/style/noNonNullAssertion: TODO fix this
-                                (_q = customAbilities[model][ability]) === null || _q === void 0 ? void 0 : _q.operation;
-                                if (!operation)
-                                    continue;
-                                // biome-ignore lint/style/noNonNullAssertion: TODO fix this
-                                abilities[model][ability] = __assign(__assign({}, customAbilities[model][ability]), { operation: operation, 
+                    try {
+                        for (models_1 = __values(models), models_1_1 = models_1.next(); !models_1_1.done; models_1_1 = models_1.next()) {
+                            model = models_1_1.value;
+                            abilities[model] = {
+                                // @ts-ignore
+                                create: {
+                                    description: "Create ".concat(model),
+                                    expression: "true",
+                                    operation: "INSERT",
+                                    // biome-ignore lint/suspicious/noExplicitAny: TODO fix this
+                                    model: model,
+                                    slug: "create",
+                                },
+                                read: {
+                                    description: "Read ".concat(model),
+                                    expression: "true",
+                                    operation: "SELECT",
+                                    // biome-ignore lint/suspicious/noExplicitAny: TODO fix this
+                                    model: model,
+                                    slug: "read",
+                                },
+                                update: {
+                                    description: "Update ".concat(model),
+                                    expression: "true",
+                                    operation: "UPDATE",
                                     // biome-ignore lint/suspicious/noExplicitAny: TODO fix this
-                                    model: model, slug: ability });
+                                    model: model,
+                                    slug: "update",
+                                },
+                                delete: {
+                                    description: "Delete ".concat(model),
+                                    expression: "true",
+                                    operation: "DELETE",
+                                    // biome-ignore lint/suspicious/noExplicitAny: TODO fix this
+                                    model: model,
+                                    slug: "delete",
+                                },
+                            };
+                            if (customAbilities === null || customAbilities === void 0 ? void 0 : customAbilities[model]) {
+                                for (ability in customAbilities[model]) {
+                                    operation = 
+                                    // biome-ignore lint/style/noNonNullAssertion: TODO fix this
+                                    (_p = customAbilities[model][ability]) === null || _p === void 0 ? void 0 : _p.operation;
+                                    if (!operation)
+                                        continue;
+                                    // biome-ignore lint/style/noNonNullAssertion: TODO fix this
+                                    abilities[model][ability] = __assign(__assign({}, customAbilities[model][ability]), { operation: operation, 
+                                        // biome-ignore lint/suspicious/noExplicitAny: TODO fix this
+                                        model: model, slug: ability });
+                                }
                             }
                         }
                     }
-                }
-                catch (e_5_1) { e_5 = { error: e_5_1 }; }
-                finally {
-                    try {
-                        if (models_1_1 && !models_1_1.done && (_p = models_1.return)) _p.call(models_1);
+                    catch (e_5_1) { e_5 = { error: e_5_1 }; }
+                    finally {
+                        try {
+                            if (models_1_1 && !models_1_1.done && (_o = models_1.return)) _o.call(models_1);
+                        }
+                        finally { if (e_5) throw e_5.error; }
                     }
-                    finally { if (e_5) throw e_5.error; }
-                }
-                roles = getRoles(abilities);
-                _c = abilities;
-                _d = [];
-                for (_e in _c)
-                    _d.push(_e);
-                _i = 0;
-                _r.label = 1;
-            case 1:
-                if (!(_i < _d.length)) return [3 /*break*/, 8];
-                _e = _d[_i];
-                if (!(_e in _c)) return [3 /*break*/, 7];
-                model = _e;
-                table = model;
-                return [4 /*yield*/, prisma.$transaction([
-                        takeLock(prisma),
-                        prisma.$queryRawUnsafe("ALTER table \"".concat(table, "\" enable row level security;")),
-                    ])];
-            case 2:
-                _r.sent();
-                _f = abilities[model];
-                _g = [];
-                for (_h in _f)
-                    _g.push(_h);
-                _j = 0;
-                _r.label = 3;
-            case 3:
-                if (!(_j < _g.length)) return [3 /*break*/, 7];
-                _h = _g[_j];
-                if (!(_h in _f)) return [3 /*break*/, 6];
-                slug = _h;
-                ability = 
-                // biome-ignore lint/style/noNonNullAssertion: TODO fix this
-                abilities[model][slug];
-                if (!VALID_OPERATIONS.includes(ability.operation)) {
-                    throw new Error("Invalid operation: ".concat(ability.operation));
-                }
-                roleName = (0, exports.createAbilityName)(model, slug);
-                // Check if role already exists
-                return [4 /*yield*/, prisma.$transaction([
-                        takeLock(prisma),
-                        prisma.$queryRawUnsafe("\n\t\t\t\t\tdo\n\t\t\t\t\t$$\n\t\t\t\t\tbegin\n\t\t\t\t\tif not exists (select * from pg_catalog.pg_roles where rolname = '".concat(roleName, "') then \n\t\t\t\t\t\tcreate role ").concat(roleName, ";\n\t\t\t\t\tend if;\n\t\t\t\t\tend\n\t\t\t\t\t$$\n\t\t\t\t\t;\n\t\t\t\t")),
-                        prisma.$queryRawUnsafe("\n\t\t\t\t\tGRANT ".concat(ability.operation, " ON \"").concat(table, "\" TO ").concat(roleName, ";\n\t\t\t\t")),
-                    ])];
-            case 4:
-                // Check if role already exists
-                _r.sent();
-                if (!ability.expression) return [3 /*break*/, 6];
-                return [4 /*yield*/, setRLS(prisma, table, roleName, ability.operation, 
-                    // biome-ignore lint/suspicious/noExplicitAny: TODO fix this
-                    ability.expression)];
-            case 5:
-                _r.sent();
-                _r.label = 6;
-            case 6:
-                _j++;
-                return [3 /*break*/, 3];
-            case 7:
-                _i++;
-                return [3 /*break*/, 1];
-            case 8:
-                _loop_1 = function (key) {
-                    var role, wildCardAbilities, roleAbilities, rlsRoles, userRoles, oldRoles;
-                    return __generator(this, function (_s) {
-                        switch (_s.label) {
-                            case 0:
-                                role = (0, exports.createRoleName)(key);
-                                return [4 /*yield*/, prisma.$executeRawUnsafe("\n\t\t\tdo\n\t\t\t$$\n\t\t\tbegin\n\t\t\tif not exists (select * from pg_catalog.pg_roles where rolname = '".concat(role, "') then \n\t\t\t\tcreate role ").concat(role, ";\n\t\t\tend if;\n\t\t\tend\n\t\t\t$$\n\t\t\t;\n\t\t"))];
-                            case 1:
-                                _s.sent();
-                                wildCardAbilities = (0, flatMap_1.default)(abilities, function (model, modelName) {
-                                    return (0, map_1.default)(model, function (_params, slug) {
-                                        return (0, exports.createAbilityName)(modelName, slug);
-                                    });
-                                });
-                                roleAbilities = roles[key];
-                                rlsRoles = roleAbilities === "*"
-                                    ? wildCardAbilities
-                                    : roleAbilities.map(function (ability) {
-                                        // biome-ignore lint/style/noNonNullAssertion: TODO fix this
-                                        return (0, exports.createAbilityName)(ability.model, ability.slug);
+                    roles = getRoles(abilities);
+                    debug("Setting row level security on tables");
+                    return [4 /*yield*/, prisma.$transaction(__spreadArray([
+                            takeLock(prisma)
+                        ], __read(Object.keys(abilities).map(function (table) {
+                            return prisma.$queryRawUnsafe("ALTER table \"".concat(table, "\" enable row level security;"));
+                        })), false))];
+                case 1:
+                    _q.sent();
+                    return [4 /*yield*/, prisma.$queryRawUnsafe("\n\t\t\tselect * from pg_catalog.pg_roles\n\t\t")];
+                case 2:
+                    pgRoles = _q.sent();
+                    return [4 /*yield*/, prisma.$queryRawUnsafe("\n\t\tselect * from pg_catalog.pg_policies;\n\t")];
+                case 3:
+                    pgPolicies = _q.sent();
+                    _b = abilities;
+                    _c = [];
+                    for (_d in _b)
+                        _c.push(_d);
+                    _i = 0;
+                    _q.label = 4;
+                case 4:
+                    if (!(_i < _c.length)) return [3 /*break*/, 9];
+                    _d = _c[_i];
+                    if (!(_d in _b)) return [3 /*break*/, 8];
+                    model = _d;
+                    table = model;
+                    _loop_1 = function (slug) {
+                        var ability, roleName;
+                        return __generator(this, function (_r) {
+                            switch (_r.label) {
+                                case 0:
+                                    ability = 
+                                    // biome-ignore lint/style/noNonNullAssertion: TODO fix this
+                                    abilities[model][slug];
+                                    if (!VALID_OPERATIONS.includes(ability.operation)) {
+                                        throw new Error("Invalid operation: ".concat(ability.operation));
+                                    }
+                                    roleName = (0, exports.createAbilityName)(model, slug);
+                                    // Check if role already exists
+                                    debug("Checking if role exists", roleName);
+                                    if (!pgRoles.find(function (role) { return role.rolname === roleName; })) return [3 /*break*/, 1];
+                                    debug("Role already exists", roleName);
+                                    return [3 /*break*/, 3];
+                                case 1: return [4 /*yield*/, prisma.$transaction([
+                                        takeLock(prisma),
+                                        prisma.$queryRawUnsafe("\n\t\t\t\t\tdo\n\t\t\t\t\t$$\n\t\t\t\t\tbegin\n\t\t\t\t\tif not exists (select * from pg_catalog.pg_roles where rolname = '".concat(roleName, "') then \n\t\t\t\t\t\tcreate role ").concat(roleName, ";\n\t\t\t\t\tend if;\n\t\t\t\t\tGRANT ").concat(ability.operation, " ON \"").concat(table, "\" TO ").concat(roleName, ";\n\t\t\t\t\tend\n\t\t\t\t\t$$\n\t\t\t\t\t;\n\t\t\t\t")),
+                                    ])];
+                                case 2:
+                                    _r.sent();
+                                    _r.label = 3;
+                                case 3:
+                                    if (!ability.expression) return [3 /*break*/, 5];
+                                    return [4 /*yield*/, setRLS(prisma, pgPolicies, table, roleName, ability.operation, 
+                                        // biome-ignore lint/suspicious/noExplicitAny: TODO fix this
+                                        ability.expression)];
+                                case 4:
+                                    _r.sent();
+                                    _r.label = 5;
+                                case 5:
+                                    debug("Finished setting RLS for model", model);
+                                    return [2 /*return*/];
+                            }
+                        });
+                    };
+                    _e = abilities[model];
+                    _f = [];
+                    for (_g in _e)
+                        _f.push(_g);
+                    _h = 0;
+                    _q.label = 5;
+                case 5:
+                    if (!(_h < _f.length)) return [3 /*break*/, 8];
+                    _g = _f[_h];
+                    if (!(_g in _e)) return [3 /*break*/, 7];
+                    slug = _g;
+                    return [5 /*yield**/, _loop_1(slug)];
+                case 6:
+                    _q.sent();
+                    _q.label = 7;
+                case 7:
+                    _h++;
+                    return [3 /*break*/, 5];
+                case 8:
+                    _i++;
+                    return [3 /*break*/, 4];
+                case 9:
+                    _loop_2 = function (key) {
+                        var role, wildCardAbilities, roleAbilities, rlsRoles, userRoles, oldRoles;
+                        return __generator(this, function (_s) {
+                            switch (_s.label) {
+                                case 0:
+                                    role = (0, exports.createRoleName)(key);
+                                    debug("Creating role", role);
+                                    wildCardAbilities = (0, flatMap_1.default)(abilities, function (model, modelName) {
+                                        return (0, map_1.default)(model, function (_params, slug) {
+                                            return (0, exports.createAbilityName)(modelName, slug);
+                                        });
                                     });
-                                // Note: We need to GRANT all on schema public so that we can resolve relation queries with prisma, as they will sometimes use a join table.
-                                // This is not ideal, but because we are using RLS, it's not a security risk. Any table with RLS also needs a corresponding policy for the role to have access.
-                                return [4 /*yield*/, prisma.$transaction([
+                                    roleAbilities = roles[key];
+                                    rlsRoles = roleAbilities === "*"
+                                        ? wildCardAbilities
+                                        : roleAbilities.map(function (ability) {
+                                            // biome-ignore lint/style/noNonNullAssertion: TODO fix this
+                                            return (0, exports.createAbilityName)(ability.model, ability.slug);
+                                        });
+                                    // Note: We need to GRANT all on schema public so that we can resolve relation queries with prisma, as they will sometimes use a join table.
+                                    // This is not ideal, but because we are using RLS, it's not a security risk. Any table with RLS also needs a corresponding policy for the role to have access.
+                                    debug("Granting role access");
+                                    // Check if role already exists
+                                    debug("Checking if role exists", role);
+                                    if (!pgRoles.find(function (row) { return row.rolname === role; })) return [3 /*break*/, 1];
+                                    debug("Role already exists", role);
+                                    return [3 /*break*/, 3];
+                                case 1: return [4 /*yield*/, prisma.$transaction([
                                         takeLock(prisma),
-                                        prisma.$executeRawUnsafe("GRANT ALL ON ALL TABLES IN SCHEMA public TO ".concat(role, ";")),
-                                        prisma.$executeRawUnsafe("\n\t\t\t\tGRANT ALL ON ALL SEQUENCES IN SCHEMA public TO ".concat(role, ";\n\t\t\t")),
-                                        prisma.$executeRawUnsafe("\n\t\t\t\tGRANT ALL ON SCHEMA public TO ".concat(role, ";\n\t\t\t")),
-                                        prisma.$queryRawUnsafe("GRANT ".concat(rlsRoles.join(", "), " TO ").concat(role)),
+                                        prisma.$executeRawUnsafe("\n\t\t\t\tdo\n\t\t\t\t$$\n\t\t\t\tbegin\n\t\t\t\tif not exists (select * from pg_catalog.pg_roles where rolname = '".concat(role, "') then \n\t\t\t\t\tcreate role ").concat(role, ";\n\t\t\t\tend if;\n\t\t\t\tGRANT ALL ON ALL TABLES IN SCHEMA public TO ").concat(role, ";\n\t\t\t\tGRANT ALL ON ALL SEQUENCES IN SCHEMA public TO ").concat(role, ";\n\t\t\t\tGRANT ALL ON SCHEMA public TO ").concat(role, ";\n\t\t\t\tend\n\t\t\t\t$$\n\t\t\t\t;\n\t\t\t")),
                                     ])];
-                            case 2:
-                                // Note: We need to GRANT all on schema public so that we can resolve relation queries with prisma, as they will sometimes use a join table.
-                                // This is not ideal, but because we are using RLS, it's not a security risk. Any table with RLS also needs a corresponding policy for the role to have access.
-                                _s.sent();
-                                return [4 /*yield*/, prisma.$queryRawUnsafe("\n\t\t\tWITH RECURSIVE cte AS (\n\t\t\t\tSELECT oid FROM pg_roles where rolname = '".concat(role, "'\n\t\t\t\tUNION ALL\n\t\t\t\tSELECT m.roleid\n\t\t\t\tFROM   cte\n\t\t\t\tJOIN   pg_auth_members m ON m.member = cte.oid\n\t\t\t\t)\n\t\t\tSELECT oid, oid::regrole::text AS rolename FROM cte where oid::regrole::text != '").concat(role, "'; \n\t "))];
-                            case 3:
-                                userRoles = _s.sent();
-                                oldRoles = userRoles
-                                    .filter(function (_a) {
-                                    var rolename = _a.rolename;
-                                    return !rlsRoles.includes(rolename);
-                                })
-                                    .map(function (_a) {
-                                    var rolename = _a.rolename;
-                                    return rolename;
-                                });
-                                if (!oldRoles.length) return [3 /*break*/, 5];
-                                // Now revoke old roles from the user role
-                                return [4 /*yield*/, prisma.$executeRawUnsafe("REVOKE ".concat(oldRoles.join(", "), " FROM ").concat(role))];
-                            case 4:
-                                // Now revoke old roles from the user role
-                                _s.sent();
-                                _s.label = 5;
-                            case 5: return [2 /*return*/];
-                        }
-                    });
-                };
-                _k = roles;
-                _l = [];
-                for (_m in _k)
-                    _l.push(_m);
-                _o = 0;
-                _r.label = 9;
-            case 9:
-                if (!(_o < _l.length)) return [3 /*break*/, 12];
-                _m = _l[_o];
-                if (!(_m in _k)) return [3 /*break*/, 11];
-                key = _m;
-                return [5 /*yield**/, _loop_1(key)];
-            case 10:
-                _r.sent();
-                _r.label = 11;
-            case 11:
-                _o++;
-                return [3 /*break*/, 9];
-            case 12: return [2 /*return*/];
-        }
+                                case 2:
+                                    _s.sent();
+                                    _s.label = 3;
+                                case 3: return [4 /*yield*/, prisma.$executeRawUnsafe("GRANT ".concat(rlsRoles.join(", "), " TO ").concat(role, ";"))];
+                                case 4:
+                                    _s.sent();
+                                    // Cleanup any old roles that aren't included in the new roles
+                                    debug("Cleaning up old roles");
+                                    return [4 /*yield*/, prisma.$queryRawUnsafe("\n\t\t\tWITH RECURSIVE cte AS (\n\t\t\t\tSELECT oid FROM pg_roles where rolname = '".concat(role, "'\n\t\t\t\tUNION ALL\n\t\t\t\tSELECT m.roleid\n\t\t\t\tFROM   cte\n\t\t\t\tJOIN   pg_auth_members m ON m.member = cte.oid\n\t\t\t\t)\n\t\t\tSELECT oid, oid::regrole::text AS rolename FROM cte where oid::regrole::text != '").concat(role, "'; \n\t "))];
+                                case 5:
+                                    userRoles = _s.sent();
+                                    oldRoles = userRoles
+                                        .filter(function (_a) {
+                                        var rolename = _a.rolename;
+                                        return !rlsRoles.includes(rolename);
+                                    })
+                                        .map(function (_a) {
+                                        var rolename = _a.rolename;
+                                        return rolename;
+                                    });
+                                    if (!oldRoles.length) return [3 /*break*/, 7];
+                                    debug("Revoking ".concat(oldRoles.length, " old roles from ").concat(role));
+                                    // Now revoke old roles from the user role
+                                    return [4 /*yield*/, prisma.$executeRawUnsafe("REVOKE ".concat(oldRoles.join(", "), " FROM ").concat(role))];
+                                case 6:
+                                    // Now revoke old roles from the user role
+                                    _s.sent();
+                                    _s.label = 7;
+                                case 7: return [2 /*return*/];
+                            }
+                        });
+                    };
+                    _j = roles;
+                    _k = [];
+                    for (_l in _j)
+                        _k.push(_l);
+                    _m = 0;
+                    _q.label = 10;
+                case 10:
+                    if (!(_m < _k.length)) return [3 /*break*/, 13];
+                    _l = _k[_m];
+                    if (!(_l in _j)) return [3 /*break*/, 12];
+                    key = _l;
+                    return [5 /*yield**/, _loop_2(key)];
+                case 11:
+                    _q.sent();
+                    _q.label = 12;
+                case 12:
+                    _m++;
+                    return [3 /*break*/, 10];
+                case 13: return [2 /*return*/];
+            }
+        });
     });
-}); };
+};
 exports.createRoles = createRoles;
 /**
  * Creates an extended client that sets contextual parameters and user role on every query
@@ -592,6 +641,7 @@ var setup = function (params) { return __awaiter(void 0, void 0, void 0, functio
         switch (_a.label) {
             case 0:
                 prisma = params.prisma, customAbilities = params.customAbilities, getRoles = params.getRoles, getContext = params.getContext;
+                debug("Creating roles");
                 return [4 /*yield*/, (0, exports.createRoles)({
                         prisma: prisma,
                         customAbilities: customAbilities,
@@ -599,7 +649,9 @@ var setup = function (params) { return __awaiter(void 0, void 0, void 0, functio
                     })];
             case 1:
                 _a.sent();
+                debug("Creating client");
                 client = (0, exports.createClient)(prisma, getContext, params.options);
+                debug("Client ready");
                 return [2 /*return*/, client];
         }
     });