@zenstackhq/language 3.0.0-beta.3 → 3.0.0-beta.5

package/dist/index.js

@@ -5354,7 +5354,7 @@ function getFunctionExpressionContext(funcDecl) {
 }
 __name(getFunctionExpressionContext, "getFunctionExpressionContext");
 function isCheckInvocation(node) {
-  return isInvocationExpr(node) && node.function.ref?.name === "check" && isFromStdlib(node.function.ref);
+  return isInvocationExpr(node) && node.function.ref?.name === "check";
 }
 __name(isCheckInvocation, "isCheckInvocation");
 function resolveTransitiveImports(documents, model) {
@@ -5649,6 +5649,7 @@ var AttributeApplicationValidator = class {
       });
     }
   }
+  // TODO: design a way to let plugin register validation
   _checkModelLevelPolicy(attr, accept) {
     const kind = getStringLiteral(attr.args[0]?.value);
     if (!kind) {
@@ -5664,8 +5665,49 @@ var AttributeApplicationValidator = class {
       "delete",
       "all"
     ], attr, accept);
-    this.rejectEncryptedFields(attr, accept);
+    if ((kind === "create" || kind === "all") && attr.args[1]?.value) {
+      this.rejectNonOwnedRelationInExpression(attr.args[1].value, accept);
+    }
+  }
+  rejectNonOwnedRelationInExpression(expr, accept) {
+    const contextModel = AstUtils2.getContainerOfType(expr, isDataModel);
+    if (!contextModel) {
+      return;
+    }
+    if (AstUtils2.streamAst(expr).some((node) => {
+      if (!isDataFieldReference(node)) {
+        return false;
+      }
+      if (node.target.ref?.$container !== contextModel) {
+        return false;
+      }
+      const field = node.target.ref;
+      if (!isRelationshipField(field)) {
+        return false;
+      }
+      if (isAuthOrAuthMemberAccess(node)) {
+        return false;
+      }
+      const startNode = isCollectionPredicate(node.$container) && node.$container.left === node ? node.$container : node;
+      const collectionPredicate = AstUtils2.getContainerOfType(startNode.$container, isCollectionPredicate);
+      if (collectionPredicate && isAuthOrAuthMemberAccess(collectionPredicate.left)) {
+        return false;
+      }
+      const relationAttr = field.attributes.find((attr) => attr.decl.ref?.name === "@relation");
+      if (!relationAttr) {
+        return true;
+      }
+      if (!relationAttr.args.some((arg) => arg.name === "fields")) {
+        return true;
+      }
+      return false;
+    })) {
+      accept("error", `non-owned relation fields are not allowed in "create" rules`, {
+        node: expr
+      });
+    }
   }
+  // TODO: design a way to let plugin register validation
   _checkFieldLevelPolicy(attr, accept) {
     const kind = getStringLiteral(attr.args[0]?.value);
     if (!kind) {
@@ -5693,7 +5735,6 @@ var AttributeApplicationValidator = class {
         });
       }
     }
-    this.rejectEncryptedFields(attr, accept);
   }
   _checkValidate(attr, accept) {
     const condition = attr.args[0]?.value;
@@ -5743,15 +5784,6 @@ var AttributeApplicationValidator = class {
       });
     }
   }
-  rejectEncryptedFields(attr, accept) {
-    AstUtils2.streamAllContents(attr).forEach((node) => {
-      if (isDataFieldReference(node) && hasAttribute(node.target.ref, "@encrypted")) {
-        accept("error", `Encrypted fields cannot be used in policy rules`, {
-          node
-        });
-      }
-    });
-  }
   validatePolicyKinds(kind, candidates, attr, accept) {
     const items = kind.split(",").map((x) => x.trim());
     items.forEach((item) => {
@@ -6509,23 +6541,25 @@ var ExpressionValidator = class {
             "Any"
           ];
         }
-        if (typeof expr.left.$resolvedType?.decl !== "string" || !supportedShapes.includes(expr.left.$resolvedType.decl)) {
+        const leftResolvedDecl = expr.left.$resolvedType?.decl;
+        const rightResolvedDecl = expr.right.$resolvedType?.decl;
+        if (leftResolvedDecl && (typeof leftResolvedDecl !== "string" || !supportedShapes.includes(leftResolvedDecl))) {
           accept("error", `invalid operand type for "${expr.operator}" operator`, {
             node: expr.left
           });
           return;
         }
-        if (typeof expr.right.$resolvedType?.decl !== "string" || !supportedShapes.includes(expr.right.$resolvedType.decl)) {
+        if (rightResolvedDecl && (typeof rightResolvedDecl !== "string" || !supportedShapes.includes(rightResolvedDecl))) {
           accept("error", `invalid operand type for "${expr.operator}" operator`, {
             node: expr.right
           });
           return;
         }
-        if (expr.left.$resolvedType.decl === "DateTime" && expr.right.$resolvedType.decl !== "DateTime") {
+        if (leftResolvedDecl === "DateTime" && rightResolvedDecl && rightResolvedDecl !== "DateTime") {
           accept("error", "incompatible operand types", {
             node: expr
           });
-        } else if (expr.right.$resolvedType.decl === "DateTime" && expr.left.$resolvedType.decl !== "DateTime") {
+        } else if (rightResolvedDecl === "DateTime" && leftResolvedDecl && leftResolvedDecl !== "DateTime") {
           accept("error", "incompatible operand types", {
             node: expr
           });
@@ -6565,11 +6599,11 @@ var ExpressionValidator = class {
             });
           }
           if (isDataFieldReference(expr.left) && (isThisExpr(expr.right) || isDataFieldReference(expr.right))) {
-            accept("error", "comparison between model-typed fields are not supported", {
+            accept("error", "comparison between models is not supported", {
               node: expr
             });
           } else if (isDataFieldReference(expr.right) && (isThisExpr(expr.left) || isDataFieldReference(expr.left))) {
-            accept("error", "comparison between model-typed fields are not supported", {
+            accept("error", "comparison between models is not supported", {
               node: expr
             });
           }
@@ -6761,6 +6795,7 @@ var FunctionInvocationValidator = class {
     }
     return true;
   }
+  // TODO: move this to policy plugin
   _checkCheck(expr, accept) {
     let valid = true;
     const fieldArg = expr.args[0].value;