@zenstackhq/language 3.0.0-beta.5 → 3.0.0-beta.6

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@zenstackhq/language",
   "description": "ZenStack ZModel language specification",
-  "version": "3.0.0-beta.5",
+  "version": "3.0.0-beta.6",
   "license": "MIT",
   "author": "ZenStack Team",
   "files": [
@@ -56,10 +56,10 @@
     "glob": "^11.0.2",
     "langium-cli": "3.5.0",
     "tmp": "^0.2.3",
-    "@zenstackhq/common-helpers": "3.0.0-beta.5",
-    "@zenstackhq/eslint-config": "3.0.0-beta.5",
-    "@zenstackhq/vitest-config": "3.0.0-beta.5",
-    "@zenstackhq/typescript-config": "3.0.0-beta.5"
+    "@zenstackhq/common-helpers": "3.0.0-beta.6",
+    "@zenstackhq/eslint-config": "3.0.0-beta.6",
+    "@zenstackhq/vitest-config": "3.0.0-beta.6",
+    "@zenstackhq/typescript-config": "3.0.0-beta.6"
   },
   "volta": {
     "node": "18.19.1",

package/res/stdlib.zmodel

@@ -116,12 +116,6 @@ function autoincrement(): Int {
 function dbgenerated(expr: String?): Any {
 } @@@expressionContext([DefaultValue])
 
-/**
- * Gets entities value before an update. Only valid when used in a "update" policy rule.
- */
-function future(): Any {
-} @@@expressionContext([AccessPolicy])
-
 /**
  * Checks if the field value contains the search string. By default, the search is case-sensitive, and
  * "LIKE" operator is used to match. If `caseInSensitive` is true, "ILIKE" operator is used if
@@ -663,3 +657,56 @@ attribute @meta(_ name: String, _ value: Any)
  * Marks an attribute as deprecated.
  */
 attribute @@@deprecated(_ message: String)
+
+/* --- Policy Plugin --- */
+
+/**
+ * Defines an access policy that allows a set of operations when the given condition is true.
+ *
+ * @param operation: comma-separated list of "create", "read", "update", "delete". Use "all" to denote all operations.
+ * @param condition: a boolean expression that controls if the operation should be allowed.
+ */
+attribute @@allow(_ operation: String @@@completionHint(["'create'", "'read'", "'update'", "'delete'", "'all'"]), _ condition: Boolean)
+
+/**
+ * Defines an access policy that allows the annotated field to be read or updated.
+ * You can pass a third argument as `true` to make it override the model-level policies.
+ *
+ * @param operation: comma-separated list of "create", "read", "update", "delete". Use "all" to denote all operations.
+ * @param condition: a boolean expression that controls if the operation should be allowed.
+ * @param override: a boolean value that controls if the field-level policy should override the model-level policy.
+ */
+attribute @allow(_ operation: String @@@completionHint(["'create'", "'read'", "'update'", "'delete'", "'all'"]), _ condition: Boolean, _ override: Boolean?)
+
+/**
+ * Defines an access policy that denies a set of operations when the given condition is true.
+ *
+ * @param operation: comma-separated list of "create", "read", "update", "delete". Use "all" to denote all operations.
+ * @param condition: a boolean expression that controls if the operation should be denied.
+ */
+attribute @@deny(_ operation: String @@@completionHint(["'create'", "'read'", "'update'", "'delete'", "'all'"]), _ condition: Boolean)
+
+/**
+ * Defines an access policy that denies the annotated field to be read or updated.
+ *
+ * @param operation: comma-separated list of "create", "read", "update", "delete". Use "all" to denote all operations.
+ * @param condition: a boolean expression that controls if the operation should be denied.
+ */
+attribute @deny(_ operation: String @@@completionHint(["'create'", "'read'", "'update'", "'delete'", "'all'"]), _ condition: Boolean)
+
+/**
+ * Checks if the current user can perform the given operation on the given field.
+ *
+ * @param field: The field to check access for
+ * @param operation: The operation to check access for. Can be "read", "create", "update", or "delete". If the operation is not provided,
+ * it defaults the operation of the containing policy rule.
+ */
+function check(field: Any, operation: String?): Boolean {
+} @@@expressionContext([AccessPolicy])
+
+/**
+ * Gets entities value before an update. Only valid when used in a "update" policy rule.
+ */
+function future(): Any {
+} @@@expressionContext([AccessPolicy])
+