@rocicorp/zero 0.25.0 → 0.26.0-canary.0

package/out/zero-cache/src/auth/write-authorizer.js

@@ -1,361 +1,428 @@
-import { LogContext } from '@rocicorp/logger';
-import { tmpdir } from 'node:os';
-import path from 'node:path';
-import { pid } from 'node:process';
 import { assert } from "../../../shared/src/asserts.js";
 import { must } from "../../../shared/src/must.js";
-import { randInt } from "../../../shared/src/rand.js";
-import * as v from "../../../shared/src/valita.js";
-import { primaryKeyValueSchema, } from "../../../zero-protocol/src/primary-key.js";
-import { bindStaticParameters, buildPipeline, } from "../../../zql/src/builder/builder.js";
+import { parse } from "../../../shared/src/valita.js";
+import { primaryKeyValueSchema } from "../../../zero-protocol/src/primary-key.js";
+import { bindStaticParameters, buildPipeline } from "../../../zql/src/builder/builder.js";
+import { consume } from "../../../zql/src/ivm/stream.js";
 import { simplifyCondition } from "../../../zql/src/query/expression.js";
-import { StaticQuery, staticQuery } from "../../../zql/src/query/static-query.js";
-import { DatabaseStorage, } from "../../../zqlite/src/database-storage.js";
-import { Database } from "../../../zqlite/src/db.js";
-import { compile, sql } from "../../../zqlite/src/internal/sql.js";
-import { fromSQLiteTypes, TableSource, } from "../../../zqlite/src/table-source.js";
+import { asQueryInternals } from "../../../zql/src/query/query-internals.js";
+import { newStaticQuery } from "../../../zql/src/query/static-query.js";
+import { sql, compile } from "../../../zqlite/src/internal/sql.js";
+import { TableSource, fromSQLiteTypes } from "../../../zqlite/src/table-source.js";
 import { computeZqlSpecs } from "../db/lite-tables.js";
 import { StatementRunner } from "../db/statements.js";
 import { mapLiteDataTypeToZqlSchemaValue } from "../types/lite.js";
-import { getSchema, reloadPermissionsIfChanged, } from "./load-permissions.js";
-export class WriteAuthorizerImpl {
-    #schema;
-    #replica;
-    #builderDelegate;
-    #tableSpecs;
-    #tables = new Map();
-    #statementRunner;
-    #lc;
-    #appID;
-    #logConfig;
-    #cgStorage;
-    #loadedPermissions = null;
-    constructor(lc, config, replica, appID, cgID) {
-        this.#appID = appID;
-        this.#lc = lc.withContext('class', 'WriteAuthorizerImpl');
-        this.#logConfig = config.log;
-        this.#schema = getSchema(this.#lc, replica);
-        this.#replica = replica;
-        const tmpDir = config.storageDBTmpDir ?? tmpdir();
-        const writeAuthzStorage = DatabaseStorage.create(lc, path.join(tmpDir, `mutagen-${pid}-${randInt(1000000, 9999999)}`));
-        this.#cgStorage = writeAuthzStorage.createClientGroupStorage(cgID);
-        this.#builderDelegate = {
-            getSource: name => this.#getSource(name),
-            createStorage: () => this.#cgStorage.createStorage(),
-            decorateSourceInput: input => input,
-            decorateInput: input => input,
-            addEdge() { },
-            decorateFilterInput: input => input,
-        };
-        this.#tableSpecs = computeZqlSpecs(this.#lc, replica);
-        this.#statementRunner = new StatementRunner(replica);
-        this.reloadPermissions();
-    }
-    reloadPermissions() {
-        this.#loadedPermissions = reloadPermissionsIfChanged(this.#lc, this.#statementRunner, this.#appID, this.#loadedPermissions).permissions;
-    }
-    destroy() {
-        this.#cgStorage.destroy();
+import { getSchema, reloadPermissionsIfChanged } from "./load-permissions.js";
+class WriteAuthorizerImpl {
+  #schema;
+  #replica;
+  #builderDelegate;
+  #tableSpecs;
+  #tables = /* @__PURE__ */ new Map();
+  #statementRunner;
+  #lc;
+  #appID;
+  #logConfig;
+  #cgStorage;
+  #loadedPermissions = null;
+  constructor(lc, config, replica, appID, cgID, writeAuthzStorage) {
+    this.#appID = appID;
+    this.#lc = lc.withContext("class", "WriteAuthorizerImpl");
+    this.#logConfig = config.log;
+    this.#schema = getSchema(this.#lc, replica);
+    this.#replica = replica;
+    this.#cgStorage = writeAuthzStorage.createClientGroupStorage(cgID);
+    this.#builderDelegate = {
+      getSource: (name) => this.#getSource(name),
+      createStorage: () => this.#cgStorage.createStorage(),
+      decorateSourceInput: (input) => input,
+      decorateInput: (input) => input,
+      addEdge() {
+      },
+      decorateFilterInput: (input) => input
+    };
+    this.#tableSpecs = computeZqlSpecs(this.#lc, replica);
+    this.#statementRunner = new StatementRunner(replica);
+    this.reloadPermissions();
+  }
+  reloadPermissions() {
+    this.#loadedPermissions = reloadPermissionsIfChanged(
+      this.#lc,
+      this.#statementRunner,
+      this.#appID,
+      this.#loadedPermissions
+    ).permissions;
+  }
+  destroy() {
+    this.#cgStorage.destroy();
+  }
+  async canPreMutation(authData, ops) {
+    for (const op of ops) {
+      switch (op.op) {
+        case "insert":
+          break;
+        case "update":
+          if (!await this.#canUpdate("preMutation", authData, op)) {
+            return false;
+          }
+          break;
+        case "delete":
+          if (!await this.#canDelete("preMutation", authData, op)) {
+            return false;
+          }
+          break;
+      }
     }
-    async canPreMutation(authData, ops) {
-        for (const op of ops) {
-            switch (op.op) {
-                case 'insert':
-                    // insert does not run pre-mutation checks
-                    break;
-                case 'update':
-                    if (!(await this.#canUpdate('preMutation', authData, op))) {
-                        return false;
-                    }
-                    break;
-                case 'delete':
-                    if (!(await this.#canDelete('preMutation', authData, op))) {
-                        return false;
-                    }
-                    break;
-            }
+    return true;
+  }
+  async canPostMutation(authData, ops) {
+    this.#statementRunner.beginConcurrent();
+    try {
+      for (const op of ops) {
+        const source = this.#getSource(op.tableName);
+        switch (op.op) {
+          case "insert": {
+            consume(
+              source.push({
+                type: "add",
+                row: op.value
+              })
+            );
+            break;
+          }
+          // TODO(mlaw): what if someone updates the same thing twice?
+          // TODO(aa): It seems like it will just work? source.push()
+          // is going to push the row into the table source, and then the
+          // next requirePreMutationRow will just return the row that was
+          // pushed in.
+          case "update": {
+            consume(
+              source.push({
+                type: "edit",
+                oldRow: this.#requirePreMutationRow(op),
+                row: op.value
+              })
+            );
+            break;
+          }
+          case "delete": {
+            consume(
+              source.push({
+                type: "remove",
+                row: this.#requirePreMutationRow(op)
+              })
+            );
+            break;
+          }
         }
-        return true;
-    }
-    async canPostMutation(authData, ops) {
-        this.#statementRunner.beginConcurrent();
-        try {
-            for (const op of ops) {
-                const source = this.#getSource(op.tableName);
-                switch (op.op) {
-                    case 'insert': {
-                        source.push({
-                            type: 'add',
-                            row: op.value,
-                        });
-                        break;
-                    }
-                    // TODO(mlaw): what if someone updates the same thing twice?
-                    // TODO(aa): It seems like it will just work? source.push()
-                    // is going to push the row into the table source, and then the
-                    // next requirePreMutationRow will just return the row that was
-                    // pushed in.
-                    case 'update': {
-                        source.push({
-                            type: 'edit',
-                            oldRow: this.#requirePreMutationRow(op),
-                            row: op.value,
-                        });
-                        break;
-                    }
-                    case 'delete': {
-                        source.push({
-                            type: 'remove',
-                            row: this.#requirePreMutationRow(op),
-                        });
-                        break;
-                    }
-                }
+      }
+      for (const op of ops) {
+        switch (op.op) {
+          case "insert":
+            if (!await this.#canInsert("postMutation", authData, op)) {
+              return false;
             }
-            for (const op of ops) {
-                switch (op.op) {
-                    case 'insert':
-                        if (!(await this.#canInsert('postMutation', authData, op))) {
-                            return false;
-                        }
-                        break;
-                    case 'update':
-                        if (!(await this.#canUpdate('postMutation', authData, op))) {
-                            return false;
-                        }
-                        break;
-                    case 'delete':
-                        // delete does not run post-mutation checks.
-                        break;
-                }
+            break;
+          case "update":
+            if (!await this.#canUpdate("postMutation", authData, op)) {
+              return false;
             }
+            break;
+          case "delete":
+            break;
         }
-        finally {
-            this.#statementRunner.rollback();
+      }
+    } finally {
+      this.#statementRunner.rollback();
+    }
+    return true;
+  }
+  normalizeOps(ops) {
+    return ops.map((op) => {
+      if (op.op === "upsert") {
+        const preMutationRow = this.#getPreMutationRow(op);
+        if (preMutationRow) {
+          return {
+            op: "update",
+            tableName: op.tableName,
+            primaryKey: op.primaryKey,
+            value: op.value
+          };
         }
-        return true;
+        return {
+          op: "insert",
+          tableName: op.tableName,
+          primaryKey: op.primaryKey,
+          value: op.value
+        };
+      }
+      return op;
+    });
+  }
+  #canInsert(phase, authData, op) {
+    return this.#timedCanDo(phase, "insert", authData, op);
+  }
+  #canUpdate(phase, authData, op) {
+    return this.#timedCanDo(phase, "update", authData, op);
+  }
+  #canDelete(phase, authData, op) {
+    return this.#timedCanDo(phase, "delete", authData, op);
+  }
+  /**
+   * Gets schema-defined primary key and validates that operation contains required PK values.
+   *
+   * @returns Record where keys are column names and values are client-provided values
+   * @throws Error if operation value is missing required primary key columns
+   */
+  #getPrimaryKey(tableName, opValue) {
+    const tableSpec = this.#tableSpecs.get(tableName);
+    if (!tableSpec) {
+      throw new Error(`Table ${tableName} not found`);
     }
-    normalizeOps(ops) {
-        return ops.map(op => {
-            if (op.op === 'upsert') {
-                const preMutationRow = this.#getPreMutationRow(op);
-                if (preMutationRow) {
-                    return {
-                        op: 'update',
-                        tableName: op.tableName,
-                        primaryKey: op.primaryKey,
-                        value: op.value,
-                    };
-                }
-                return {
-                    op: 'insert',
-                    tableName: op.tableName,
-                    primaryKey: op.primaryKey,
-                    value: op.value,
-                };
-            }
-            return op;
-        });
+    const columns = tableSpec.tableSpec.primaryKey;
+    const values = {};
+    for (const col of columns) {
+      const val = opValue[col];
+      if (val === void 0) {
+        throw new Error(
+          `Primary key column '${col}' is missing from operation value for table ${tableName}`
+        );
+      }
+      values[col] = val;
     }
-    #canInsert(phase, authData, op) {
-        return this.#timedCanDo(phase, 'insert', authData, op);
+    return values;
+  }
+  #getSource(tableName) {
+    let source = this.#tables.get(tableName);
+    if (source) {
+      return source;
     }
-    #canUpdate(phase, authData, op) {
-        return this.#timedCanDo(phase, 'update', authData, op);
+    const tableSpec = this.#tableSpecs.get(tableName);
+    if (!tableSpec) {
+      throw new Error(`Table ${tableName} not found`);
     }
-    #canDelete(phase, authData, op) {
-        return this.#timedCanDo(phase, 'delete', authData, op);
+    const { columns, primaryKey } = tableSpec.tableSpec;
+    assert(primaryKey.length);
+    source = new TableSource(
+      this.#lc,
+      this.#logConfig,
+      this.#replica,
+      tableName,
+      Object.fromEntries(
+        Object.entries(columns).map(([name, { dataType }]) => [
+          name,
+          mapLiteDataTypeToZqlSchemaValue(dataType)
+        ])
+      ),
+      [primaryKey[0], ...primaryKey.slice(1)]
+    );
+    this.#tables.set(tableName, source);
+    return source;
+  }
+  async #timedCanDo(phase, action, authData, op) {
+    const start = performance.now();
+    try {
+      const ret = await this.#canDo(phase, action, authData, op);
+      return ret;
+    } finally {
+      this.#lc.info?.(
+        "action:",
+        action,
+        "duration:",
+        performance.now() - start,
+        "tableName:",
+        op.tableName,
+        "primaryKey:",
+        op.primaryKey
+      );
     }
-    #getSource(tableName) {
-        let source = this.#tables.get(tableName);
-        if (source) {
-            return source;
-        }
-        const tableSpec = this.#tableSpecs.get(tableName);
-        if (!tableSpec) {
-            throw new Error(`Table ${tableName} not found`);
-        }
-        const { columns, primaryKey } = tableSpec.tableSpec;
-        assert(primaryKey.length);
-        source = new TableSource(this.#lc, this.#logConfig, this.#replica, tableName, Object.fromEntries(Object.entries(columns).map(([name, { dataType }]) => [
-            name,
-            mapLiteDataTypeToZqlSchemaValue(dataType),
-        ])), [primaryKey[0], ...primaryKey.slice(1)]);
-        this.#tables.set(tableName, source);
-        return source;
+  }
+  /**
+   * Evaluation order is from static to dynamic, broad to specific.
+   * table -> column -> row -> cell.
+   *
+   * If any step fails, the entire operation is denied.
+   *
+   * That is, table rules supersede column rules, which supersede row rules,
+   *
+   * All steps must allow for the operation to be allowed.
+   */
+  async #canDo(phase, action, authData, op) {
+    const rules = must(this.#loadedPermissions)?.permissions?.tables?.[op.tableName];
+    const rowPolicies = rules?.row;
+    let rowQuery = newStaticQuery(this.#schema, op.tableName);
+    const primaryKeyValues = this.#getPrimaryKey(op.tableName, op.value);
+    for (const pk in primaryKeyValues) {
+      rowQuery = rowQuery.where(pk, "=", primaryKeyValues[pk]);
     }
-    async #timedCanDo(phase, action, authData, op) {
-        const start = performance.now();
-        try {
-            const ret = await this.#canDo(phase, action, authData, op);
-            return ret;
+    let applicableRowPolicy;
+    switch (action) {
+      case "insert":
+        if (phase === "postMutation") {
+          applicableRowPolicy = rowPolicies?.insert;
         }
-        finally {
-            this.#lc.info?.('action:', action, 'duration:', performance.now() - start, 'tableName:', op.tableName, 'primaryKey:', op.primaryKey);
+        break;
+      case "update":
+        if (phase === "preMutation") {
+          applicableRowPolicy = rowPolicies?.update?.preMutation;
+        } else if (phase === "postMutation") {
+          applicableRowPolicy = rowPolicies?.update?.postMutation;
         }
+        break;
+      case "delete":
+        if (phase === "preMutation") {
+          applicableRowPolicy = rowPolicies?.delete;
+        }
+        break;
     }
-    /**
-     * Evaluation order is from static to dynamic, broad to specific.
-     * table -> column -> row -> cell.
-     *
-     * If any step fails, the entire operation is denied.
-     *
-     * That is, table rules supersede column rules, which supersede row rules,
-     *
-     * All steps must allow for the operation to be allowed.
-     */
-    async #canDo(phase, action, authData, op) {
-        const rules = must(this.#loadedPermissions).permissions?.tables[op.tableName];
-        const rowPolicies = rules?.row;
-        let rowQuery = staticQuery(this.#schema, op.tableName);
-        op.primaryKey.forEach(pk => {
-            // oxlint-disable-next-line @typescript-eslint/no-explicit-any
-            rowQuery = rowQuery.where(pk, '=', op.value[pk]);
-        });
-        let applicableRowPolicy;
-        switch (action) {
-            case 'insert':
-                if (phase === 'postMutation') {
-                    applicableRowPolicy = rowPolicies?.insert;
-                }
-                break;
-            case 'update':
-                if (phase === 'preMutation') {
-                    applicableRowPolicy = rowPolicies?.update?.preMutation;
-                }
-                else if (phase === 'postMutation') {
-                    applicableRowPolicy = rowPolicies?.update?.postMutation;
-                }
-                break;
-            case 'delete':
-                if (phase === 'preMutation') {
-                    applicableRowPolicy = rowPolicies?.delete;
-                }
-                break;
+    const cellPolicies = rules?.cell;
+    const applicableCellPolicies = [];
+    if (cellPolicies) {
+      for (const [column, policy] of Object.entries(cellPolicies)) {
+        if (action === "update" && op.value[column] === void 0) {
+          continue;
         }
-        const cellPolicies = rules?.cell;
-        const applicableCellPolicies = [];
-        if (cellPolicies) {
-            for (const [column, policy] of Object.entries(cellPolicies)) {
-                if (action === 'update' && op.value[column] === undefined) {
-                    // If the cell is not being updated, we do not need to check
-                    // the cell rules.
-                    continue;
-                }
-                switch (action) {
-                    case 'insert':
-                        if (policy.insert && phase === 'postMutation') {
-                            applicableCellPolicies.push(policy.insert);
-                        }
-                        break;
-                    case 'update':
-                        if (phase === 'preMutation' && policy.update?.preMutation) {
-                            applicableCellPolicies.push(policy.update.preMutation);
-                        }
-                        if (phase === 'postMutation' && policy.update?.postMutation) {
-                            applicableCellPolicies.push(policy.update.postMutation);
-                        }
-                        break;
-                    case 'delete':
-                        if (policy.delete && phase === 'preMutation') {
-                            applicableCellPolicies.push(policy.delete);
-                        }
-                        break;
-                }
+        switch (action) {
+          case "insert":
+            if (policy.insert && phase === "postMutation") {
+              applicableCellPolicies.push(policy.insert);
             }
+            break;
+          case "update":
+            if (phase === "preMutation" && policy.update?.preMutation) {
+              applicableCellPolicies.push(policy.update.preMutation);
+            }
+            if (phase === "postMutation" && policy.update?.postMutation) {
+              applicableCellPolicies.push(policy.update.postMutation);
+            }
+            break;
+          case "delete":
+            if (policy.delete && phase === "preMutation") {
+              applicableCellPolicies.push(policy.delete);
+            }
+            break;
         }
-        if (!(await this.#passesPolicyGroup(applicableRowPolicy, applicableCellPolicies, authData, rowQuery))) {
-            this.#lc.warn?.(`Permission check failed for ${JSON.stringify(op)}, action ${action}, phase ${phase}, authData: ${JSON.stringify(authData)}, rowPolicies: ${JSON.stringify(applicableRowPolicy)}, cellPolicies: ${JSON.stringify(applicableCellPolicies)}`);
-            return false;
-        }
-        return true;
+      }
     }
-    #getPreMutationRow(op) {
-        const { value } = op;
-        const conditions = [];
-        const values = [];
-        for (const pk of op.primaryKey) {
-            conditions.push(sql `${sql.ident(pk)}=?`);
-            values.push(v.parse(value[pk], primaryKeyValueSchema));
-        }
-        const spec = this.#tableSpecs.get(op.tableName);
-        if (spec === undefined) {
-            throw new Error(`Table ${op.tableName} not found`);
-        }
-        const ret = this.#statementRunner.get(compile(sql `SELECT ${sql.join(Object.keys(spec.zqlSpec).map(c => sql.ident(c)), sql `,`)} FROM ${sql.ident(op.tableName)} WHERE ${sql.join(conditions, sql ` AND `)}`), ...values);
-        if (ret === undefined) {
-            return ret;
-        }
-        return fromSQLiteTypes(spec.zqlSpec, ret, op.tableName);
+    if (!await this.#passesPolicyGroup(
+      applicableRowPolicy,
+      applicableCellPolicies,
+      authData,
+      rowQuery
+    )) {
+      this.#lc.warn?.(
+        `Permission check failed for ${JSON.stringify(
+          op
+        )}, action ${action}, phase ${phase}, authData: ${JSON.stringify(
+          authData
+        )}, rowPolicies: ${JSON.stringify(
+          applicableRowPolicy
+        )}, cellPolicies: ${JSON.stringify(applicableCellPolicies)}`
+      );
+      return false;
     }
-    #requirePreMutationRow(op) {
-        const ret = this.#getPreMutationRow(op);
-        assert(ret !== undefined, () => `Pre-mutation row not found for ${JSON.stringify(op.value)}`);
-        return ret;
+    return true;
+  }
+  #getPreMutationRow(op) {
+    const { value } = op;
+    const primaryKeyValues = this.#getPrimaryKey(op.tableName, value);
+    const spec = this.#tableSpecs.get(op.tableName);
+    if (!spec) {
+      throw new Error(`Table ${op.tableName} not found`);
     }
-    async #passesPolicyGroup(applicableRowPolicy, applicableCellPolicies, authData, rowQuery) {
-        if (!(await this.#passesPolicy(applicableRowPolicy, authData, rowQuery))) {
-            return false;
-        }
-        for (const policy of applicableCellPolicies) {
-            if (!(await this.#passesPolicy(policy, authData, rowQuery))) {
-                return false;
-            }
-        }
-        return true;
+    const conditions = [];
+    const values = [];
+    for (const pk in primaryKeyValues) {
+      conditions.push(sql`${sql.ident(pk)}=?`);
+      values.push(parse(primaryKeyValues[pk], primaryKeyValueSchema));
     }
-    /**
-     * Defaults to *false* if the policy is empty. At least one rule has to pass
-     * for the policy to pass.
-     */
-    #passesPolicy(policy, authData, rowQuery) {
-        if (policy === undefined) {
-            return false;
-        }
-        if (policy.length === 0) {
-            return false;
-        }
-        let rowQueryAst = rowQuery.ast;
-        rowQueryAst = bindStaticParameters({
-            ...rowQueryAst,
-            where: updateWhere(rowQueryAst.where, policy),
-        }, {
-            authData: authData,
-            preMutationRow: undefined,
-        });
-        // call the compiler directly
-        // run the sql against upstream.
-        // remove the collecting into json? just need to know if a row comes back.
-        const input = buildPipeline(rowQueryAst, this.#builderDelegate, 'query-id');
-        try {
-            const res = input.fetch({});
-            for (const _ of res) {
-                // if any row is returned at all, the
-                // rule passes.
-                return true;
-            }
-        }
-        finally {
-            input.destroy();
-        }
-        // no rows returned by any rules? The policy fails.
+    const ret = this.#statementRunner.get(
+      compile(
+        sql`SELECT ${sql.join(
+          Object.keys(spec.zqlSpec).map((c) => sql.ident(c)),
+          sql`,`
+        )} FROM ${sql.ident(op.tableName)} WHERE ${sql.join(
+          conditions,
+          sql` AND `
+        )}`
+      ),
+      ...values
+    );
+    if (ret === void 0) {
+      return ret;
+    }
+    return fromSQLiteTypes(spec.zqlSpec, ret, op.tableName);
+  }
+  #requirePreMutationRow(op) {
+    const ret = this.#getPreMutationRow(op);
+    assert(
+      ret !== void 0,
+      () => `Pre-mutation row not found for ${JSON.stringify(op.value)}`
+    );
+    return ret;
+  }
+  async #passesPolicyGroup(applicableRowPolicy, applicableCellPolicies, authData, rowQuery) {
+    if (!await this.#passesPolicy(applicableRowPolicy, authData, rowQuery)) {
+      return false;
+    }
+    for (const policy of applicableCellPolicies) {
+      if (!await this.#passesPolicy(policy, authData, rowQuery)) {
         return false;
+      }
     }
+    return true;
+  }
+  /**
+   * Defaults to *false* if the policy is empty. At least one rule has to pass
+   * for the policy to pass.
+   */
+  #passesPolicy(policy, authData, rowQuery) {
+    if (policy === void 0) {
+      return false;
+    }
+    if (policy.length === 0) {
+      return false;
+    }
+    let rowQueryAst = asQueryInternals(rowQuery).ast;
+    rowQueryAst = bindStaticParameters(
+      {
+        ...rowQueryAst,
+        where: updateWhere(rowQueryAst.where, policy)
+      },
+      {
+        authData,
+        preMutationRow: void 0
+      }
+    );
+    const input = buildPipeline(rowQueryAst, this.#builderDelegate, "query-id");
+    try {
+      const res = input.fetch({});
+      for (const _ of res) {
+        return true;
+      }
+    } finally {
+      input.destroy();
+    }
+    return false;
+  }
 }
 function updateWhere(where, policy) {
-    assert(where, 'A where condition must exist for RowQuery');
-    return simplifyCondition({
-        type: 'and',
-        conditions: [
-            where,
-            {
-                type: 'or',
-                conditions: policy.map(([action, rule]) => {
-                    assert(action);
-                    return rule;
-                }),
-            },
-        ],
-    });
+  assert(where, "A where condition must exist for RowQuery");
+  return simplifyCondition({
+    type: "and",
+    conditions: [
+      where,
+      {
+        type: "or",
+        conditions: policy.map(([action, rule]) => {
+          assert(action);
+          return rule;
+        })
+      }
+    ]
+  });
 }
-//# sourceMappingURL=write-authorizer.js.map
+export {
+  WriteAuthorizerImpl
+};
+//# sourceMappingURL=write-authorizer.js.map