@zenstackhq/plugin-policy 3.0.0-beta.25 → 3.0.0-beta.26

package/dist/index.cjs

@@ -107,6 +107,12 @@ var ExpressionEvaluator = class {
     }
     const left = this.evaluate(expr2.left, context);
     const right = this.evaluate(expr2.right, context);
+    if (![
+      "==",
+      "!="
+    ].includes(expr2.op) && (left === null || right === null)) {
+      return null;
+    }
     return (0, import_ts_pattern.match)(expr2.op).with("==", () => left === right).with("!=", () => left !== right).with(">", () => left > right).with(">=", () => left >= right).with("<", () => left < right).with("<=", () => left <= right).with("&&", () => left && right).with("||", () => left || right).with("in", () => {
       const _right = right ?? [];
       (0, import_common_helpers.invariant)(Array.isArray(_right), 'expected array for "in" operator');
@@ -117,8 +123,8 @@ var ExpressionEvaluator = class {
     const op = expr2.op;
     (0, import_common_helpers.invariant)(op === "?" || op === "!" || op === "^", 'expected "?" or "!" or "^" operator');
     const left = this.evaluate(expr2.left, context);
-    if (!left) {
-      return false;
+    if (left === null || left === void 0) {
+      return null;
     }
     (0, import_common_helpers.invariant)(Array.isArray(left), "expected array");
     return (0, import_ts_pattern.match)(op).with("?", () => left.some((item) => this.evaluate(expr2.right, {
@@ -134,6 +140,13 @@ var ExpressionEvaluator = class {
   }
 };
 
+// src/types.ts
+var CollectionPredicateOperator = [
+  "?",
+  "!",
+  "^"
+];
+
 // src/utils.ts
 var import_orm2 = require("@zenstackhq/orm");
 var import_schema2 = require("@zenstackhq/orm/schema");
@@ -310,7 +323,11 @@ var ExpressionTransformer = class {
     return import_kysely2.ValueListNode.create(expr2.items.map((item) => this.transform(item, context)));
   }
   _field(expr2, context) {
-    const fieldDef = import_orm3.QueryUtils.requireField(this.schema, context.model, expr2.field);
+    if (context.contextValue) {
+      const fieldDef2 = import_orm3.QueryUtils.requireField(this.schema, context.modelOrType, expr2.field);
+      return this.transformValue(context.contextValue[expr2.field], fieldDef2.type);
+    }
+    const fieldDef = import_orm3.QueryUtils.requireField(this.schema, context.modelOrType, expr2.field);
     if (!fieldDef.relation) {
       return this.createColumnRef(expr2.field, context);
     } else {
@@ -384,30 +401,39 @@ var ExpressionTransformer = class {
     }
   }
   transformNullCheck(expr2, operator) {
-    (0, import_common_helpers2.invariant)(operator === "==" || operator === "!=", 'operator must be "==" or "!=" for null comparison');
-    if (import_kysely2.ValueNode.is(expr2)) {
-      if (expr2.value === null) {
-        return operator === "==" ? trueNode(this.dialect) : falseNode(this.dialect);
+    if (operator === "==" || operator === "!=") {
+      if (import_kysely2.ValueNode.is(expr2)) {
+        if (expr2.value === null) {
+          return operator === "==" ? trueNode(this.dialect) : falseNode(this.dialect);
+        } else {
+          return operator === "==" ? falseNode(this.dialect) : trueNode(this.dialect);
+        }
       } else {
-        return operator === "==" ? falseNode(this.dialect) : trueNode(this.dialect);
+        return operator === "==" ? import_kysely2.BinaryOperationNode.create(expr2, import_kysely2.OperatorNode.create("is"), import_kysely2.ValueNode.createImmediate(null)) : import_kysely2.BinaryOperationNode.create(expr2, import_kysely2.OperatorNode.create("is not"), import_kysely2.ValueNode.createImmediate(null));
       }
     } else {
-      return operator === "==" ? import_kysely2.BinaryOperationNode.create(expr2, import_kysely2.OperatorNode.create("is"), import_kysely2.ValueNode.createImmediate(null)) : import_kysely2.BinaryOperationNode.create(expr2, import_kysely2.OperatorNode.create("is not"), import_kysely2.ValueNode.createImmediate(null));
+      return import_kysely2.ValueNode.createImmediate(null);
     }
   }
   normalizeBinaryOperationOperands(expr2, context) {
+    if (context.contextValue) {
+      return {
+        normalizedLeft: expr2.left,
+        normalizedRight: expr2.right
+      };
+    }
     let normalizedLeft = expr2.left;
-    if (this.isRelationField(expr2.left, context.model)) {
+    if (this.isRelationField(expr2.left, context.modelOrType)) {
       (0, import_common_helpers2.invariant)(import_schema3.ExpressionUtils.isNull(expr2.right), "only null comparison is supported for relation field");
-      const leftRelDef = this.getFieldDefFromFieldRef(expr2.left, context.model);
+      const leftRelDef = this.getFieldDefFromFieldRef(expr2.left, context.modelOrType);
       (0, import_common_helpers2.invariant)(leftRelDef, "failed to get relation field definition");
       const idFields = import_orm3.QueryUtils.requireIdFields(this.schema, leftRelDef.type);
       normalizedLeft = this.makeOrAppendMember(normalizedLeft, idFields[0]);
     }
     let normalizedRight = expr2.right;
-    if (this.isRelationField(expr2.right, context.model)) {
+    if (this.isRelationField(expr2.right, context.modelOrType)) {
       (0, import_common_helpers2.invariant)(import_schema3.ExpressionUtils.isNull(expr2.left), "only null comparison is supported for relation field");
-      const rightRelDef = this.getFieldDefFromFieldRef(expr2.right, context.model);
+      const rightRelDef = this.getFieldDefFromFieldRef(expr2.right, context.modelOrType);
       (0, import_common_helpers2.invariant)(rightRelDef, "failed to get relation field definition");
       const idFields = import_orm3.QueryUtils.requireIdFields(this.schema, rightRelDef.type);
       normalizedRight = this.makeOrAppendMember(normalizedRight, idFields[0]);
@@ -418,22 +444,30 @@ var ExpressionTransformer = class {
     };
   }
   transformCollectionPredicate(expr2, context) {
-    (0, import_common_helpers2.invariant)(expr2.op === "?" || expr2.op === "!" || expr2.op === "^", 'expected "?" or "!" or "^" operator');
-    if (this.isAuthCall(expr2.left) || this.isAuthMember(expr2.left)) {
-      const value = new ExpressionEvaluator().evaluate(expr2, {
+    this.ensureCollectionPredicateOperator(expr2.op);
+    if (this.isAuthMember(expr2.left) || context.contextValue) {
+      (0, import_common_helpers2.invariant)(import_schema3.ExpressionUtils.isMember(expr2.left) || import_schema3.ExpressionUtils.isField(expr2.left), "expected member or field expression");
+      const evaluator = new ExpressionEvaluator();
+      const receiver = evaluator.evaluate(expr2.left, {
+        thisValue: context.contextValue,
         auth: this.auth
       });
-      return this.transformValue(value, "Boolean");
+      const baseType = this.isAuthMember(expr2.left) ? this.authType : context.modelOrType;
+      const memberType = this.getMemberType(baseType, expr2.left);
+      return this.transformValueCollectionPredicate(receiver, expr2, {
+        ...context,
+        modelOrType: memberType
+      });
     }
     (0, import_common_helpers2.invariant)(import_schema3.ExpressionUtils.isField(expr2.left) || import_schema3.ExpressionUtils.isMember(expr2.left), "left operand must be field or member access");
     let newContextModel;
-    const fieldDef = this.getFieldDefFromFieldRef(expr2.left, context.model);
+    const fieldDef = this.getFieldDefFromFieldRef(expr2.left, context.modelOrType);
     if (fieldDef) {
       (0, import_common_helpers2.invariant)(fieldDef.relation, `field is not a relation: ${JSON.stringify(expr2.left)}`);
       newContextModel = fieldDef.type;
     } else {
       (0, import_common_helpers2.invariant)(import_schema3.ExpressionUtils.isMember(expr2.left) && import_schema3.ExpressionUtils.isField(expr2.left.receiver), "left operand must be member access with field receiver");
-      const fieldDef2 = import_orm3.QueryUtils.requireField(this.schema, context.model, expr2.left.receiver.field);
+      const fieldDef2 = import_orm3.QueryUtils.requireField(this.schema, context.modelOrType, expr2.left.receiver.field);
       newContextModel = fieldDef2.type;
       for (const member of expr2.left.members) {
         const memberDef = import_orm3.QueryUtils.requireField(this.schema, newContextModel, member);
@@ -442,7 +476,7 @@ var ExpressionTransformer = class {
     }
     let predicateFilter = this.transform(expr2.right, {
       ...context,
-      model: newContextModel,
+      modelOrType: newContextModel,
       alias: void 0
     });
     if (expr2.op === "!") {
@@ -458,9 +492,49 @@ var ExpressionTransformer = class {
       memberFilter: predicateFilter
     });
   }
+  ensureCollectionPredicateOperator(op) {
+    (0, import_common_helpers2.invariant)(CollectionPredicateOperator.includes(op), 'expected "?" or "!" or "^" operator');
+  }
+  transformValueCollectionPredicate(receiver, expr2, context) {
+    if (!receiver) {
+      return import_kysely2.ValueNode.createImmediate(null);
+    }
+    this.ensureCollectionPredicateOperator(expr2.op);
+    const visitor = new import_orm3.SchemaUtils.MatchingExpressionVisitor((e) => import_schema3.ExpressionUtils.isThis(e));
+    if (!visitor.find(expr2.right)) {
+      const value = new ExpressionEvaluator().evaluate(expr2, {
+        auth: this.auth,
+        thisValue: context.contextValue
+      });
+      return this.transformValue(value, "Boolean");
+    } else {
+      (0, import_common_helpers2.invariant)(Array.isArray(receiver), "array value is expected");
+      const components = receiver.map((item) => this.transform(expr2.right, {
+        operation: context.operation,
+        thisType: context.thisType,
+        thisAlias: context.thisAlias,
+        modelOrType: context.modelOrType,
+        contextValue: item
+      }));
+      return (0, import_ts_pattern2.match)(expr2.op).with("?", () => disjunction(this.dialect, components)).with("!", () => conjunction(this.dialect, components)).with("^", () => logicalNot(this.dialect, disjunction(this.dialect, components))).exhaustive();
+    }
+  }
+  getMemberType(receiverType, expr2) {
+    if (import_schema3.ExpressionUtils.isField(expr2)) {
+      const fieldDef = import_orm3.QueryUtils.requireField(this.schema, receiverType, expr2.field);
+      return fieldDef.type;
+    } else {
+      let currType = receiverType;
+      for (const member of expr2.members) {
+        const fieldDef = import_orm3.QueryUtils.requireField(this.schema, currType, member);
+        currType = fieldDef.type;
+      }
+      return currType;
+    }
+  }
   transformAuthBinary(expr2, context) {
     if (expr2.op !== "==" && expr2.op !== "!=") {
-      throw createUnsupportedError(`Unsupported operator for \`auth()\` in policy of model "${context.model}": ${expr2.op}`);
+      throw createUnsupportedError(`Unsupported operator for \`auth()\` in policy of model "${context.modelOrType}": ${expr2.op}`);
     }
     let authExpr;
     let other;
@@ -476,7 +550,7 @@ var ExpressionTransformer = class {
     } else {
       const authModel = import_orm3.QueryUtils.getModel(this.schema, this.authType);
       if (!authModel) {
-        throw createUnsupportedError(`Unsupported use of \`auth()\` in policy of model "${context.model}", comparing with \`auth()\` is only possible when auth type is a model`);
+        throw createUnsupportedError(`Unsupported use of \`auth()\` in policy of model "${context.modelOrType}", comparing with \`auth()\` is only possible when auth type is a model`);
       }
       const idFields = Object.values(authModel.fields).filter((f) => f.id).map((f) => f.name);
       (0, import_common_helpers2.invariant)(idFields.length > 0, "auth type model must have at least one id field");
@@ -508,7 +582,12 @@ var ExpressionTransformer = class {
     } else if (value === false) {
       return falseNode(this.dialect);
     } else {
-      return import_kysely2.ValueNode.create(this.dialect.transformPrimitive(value, type, false) ?? null);
+      const transformed = this.dialect.transformPrimitive(value, type, false) ?? null;
+      if (!Array.isArray(transformed)) {
+        return import_kysely2.ValueNode.createImmediate(transformed);
+      } else {
+        return import_kysely2.ValueNode.create(transformed);
+      }
     }
   }
   _unary(expr2, context) {
@@ -532,8 +611,8 @@ var ExpressionTransformer = class {
     return func(eb, (expr2.args ?? []).map((arg) => this.transformCallArg(eb, arg, context)), {
       client: this.client,
       dialect: this.dialect,
-      model: context.model,
-      modelAlias: context.alias ?? context.model,
+      model: context.modelOrType,
+      modelAlias: context.alias ?? context.modelOrType,
       operation: context.operation
     });
   }
@@ -580,9 +659,15 @@ var ExpressionTransformer = class {
     const { memberFilter, memberSelect, ...restContext } = context;
     if (import_schema3.ExpressionUtils.isThis(expr2.receiver)) {
       if (expr2.members.length === 1) {
-        return this._field(import_schema3.ExpressionUtils.field(expr2.members[0]), context);
+        return this._field(import_schema3.ExpressionUtils.field(expr2.members[0]), {
+          ...context,
+          alias: context.thisAlias,
+          modelOrType: context.thisType,
+          thisType: context.thisType,
+          contextValue: void 0
+        });
       } else {
-        const firstMemberFieldDef = import_orm3.QueryUtils.requireField(this.schema, context.model, expr2.members[0]);
+        const firstMemberFieldDef = import_orm3.QueryUtils.requireField(this.schema, context.thisType, expr2.members[0]);
         receiver = this.transformRelationAccess(expr2.members[0], firstMemberFieldDef.type, restContext);
         members = expr2.members.slice(1);
       }
@@ -592,10 +677,10 @@ var ExpressionTransformer = class {
     (0, import_common_helpers2.invariant)(import_kysely2.SelectQueryNode.is(receiver), "expected receiver to be select query");
     let startType;
     if (import_schema3.ExpressionUtils.isField(expr2.receiver)) {
-      const receiverField = import_orm3.QueryUtils.requireField(this.schema, context.model, expr2.receiver.field);
+      const receiverField = import_orm3.QueryUtils.requireField(this.schema, context.modelOrType, expr2.receiver.field);
       startType = receiverField.type;
     } else {
-      startType = context.model;
+      startType = context.thisType;
     }
     const memberFields = [];
     let currType = startType;
@@ -614,7 +699,7 @@ var ExpressionTransformer = class {
       if (fieldDef.relation) {
         const relation = this.transformRelationAccess(member, fieldDef.type, {
           ...restContext,
-          model: fromModel,
+          modelOrType: fromModel,
           alias: void 0
         });
         if (currNode) {
@@ -650,20 +735,29 @@ var ExpressionTransformer = class {
     if (!receiver) {
       return import_kysely2.ValueNode.createImmediate(null);
     }
-    if (expr2.members.length !== 1) {
-      throw new Error(`Only single member access is supported`);
+    (0, import_common_helpers2.invariant)(expr2.members.length > 0, "member expression must have at least one member");
+    let curr = receiver;
+    let currType = receiverType;
+    for (let i = 0; i < expr2.members.length; i++) {
+      const field = expr2.members[i];
+      curr = curr?.[field];
+      if (curr === void 0) {
+        curr = import_kysely2.ValueNode.createImmediate(null);
+        break;
+      }
+      currType = import_orm3.QueryUtils.requireField(this.schema, currType, field).type;
+      if (i === expr2.members.length - 1) {
+        curr = this.transformValue(curr, currType);
+      }
     }
-    const field = expr2.members[0];
-    const fieldDef = import_orm3.QueryUtils.requireField(this.schema, receiverType, field);
-    const fieldValue = receiver[field] ?? null;
-    return this.transformValue(fieldValue, fieldDef.type);
+    return curr;
   }
   transformRelationAccess(field, relationModel, context) {
-    const m2m = import_orm3.QueryUtils.getManyToManyRelation(this.schema, context.model, field);
+    const m2m = import_orm3.QueryUtils.getManyToManyRelation(this.schema, context.modelOrType, field);
     if (m2m) {
       return this.transformManyToManyRelationAccess(m2m, context);
     }
-    const fromModel = context.model;
+    const fromModel = context.modelOrType;
     const relationFieldDef = import_orm3.QueryUtils.requireField(this.schema, fromModel, field);
     const { keyPairs, ownedByModel } = import_orm3.QueryUtils.getRelationForeignKeyFieldPairs(this.schema, fromModel, field);
     let condition;
@@ -688,19 +782,19 @@ var ExpressionTransformer = class {
   }
   transformManyToManyRelationAccess(m2m, context) {
     const eb = (0, import_kysely2.expressionBuilder)();
-    const relationQuery = eb.selectFrom(m2m.otherModel).innerJoin(m2m.joinTable, (join) => join.onRef(`${m2m.otherModel}.${m2m.otherPKName}`, "=", `${m2m.joinTable}.${m2m.otherFkName}`).onRef(`${m2m.joinTable}.${m2m.parentFkName}`, "=", `${context.alias ?? context.model}.${m2m.parentPKName}`));
+    const relationQuery = eb.selectFrom(m2m.otherModel).innerJoin(m2m.joinTable, (join) => join.onRef(`${m2m.otherModel}.${m2m.otherPKName}`, "=", `${m2m.joinTable}.${m2m.otherFkName}`).onRef(`${m2m.joinTable}.${m2m.parentFkName}`, "=", `${context.alias ?? context.modelOrType}.${m2m.parentPKName}`));
     return relationQuery.toOperationNode();
   }
   createColumnRef(column, context) {
-    const tableName = context.alias ?? context.model;
+    const tableName = context.alias ?? context.modelOrType;
     if (context.operation === "create") {
       return import_kysely2.ReferenceNode.create(import_kysely2.ColumnNode.create(column), import_kysely2.TableNode.create(tableName));
     }
-    const fieldDef = import_orm3.QueryUtils.requireField(this.schema, context.model, column);
-    if (!fieldDef.originModel || fieldDef.originModel === context.model) {
+    const fieldDef = import_orm3.QueryUtils.requireField(this.schema, context.modelOrType, column);
+    if (!fieldDef.originModel || fieldDef.originModel === context.modelOrType) {
       return import_kysely2.ReferenceNode.create(import_kysely2.ColumnNode.create(column), import_kysely2.TableNode.create(tableName));
     }
-    return this.buildDelegateBaseFieldSelect(context.model, tableName, column, fieldDef.originModel);
+    return this.buildDelegateBaseFieldSelect(context.modelOrType, tableName, column, fieldDef.originModel);
   }
   buildDelegateBaseFieldSelect(model, modelAlias, field, baseModel) {
     const idFields = import_orm3.QueryUtils.requireIdFields(this.client.$schema, model);
@@ -742,9 +836,9 @@ var ExpressionTransformer = class {
   }
   getFieldDefFromFieldRef(expr2, model) {
     if (import_schema3.ExpressionUtils.isField(expr2)) {
-      return import_orm3.QueryUtils.requireField(this.schema, model, expr2.field);
+      return import_orm3.QueryUtils.getField(this.schema, model, expr2.field);
     } else if (import_schema3.ExpressionUtils.isMember(expr2) && expr2.members.length === 1 && import_schema3.ExpressionUtils.isThis(expr2.receiver)) {
-      return import_orm3.QueryUtils.requireField(this.schema, model, expr2.members[0]);
+      return import_orm3.QueryUtils.getField(this.schema, model, expr2.members[0]);
     } else {
       return void 0;
     }
@@ -1410,7 +1504,9 @@ var PolicyHandler = class extends import_kysely3.OperationNodeTransformer {
   }
   compilePolicyCondition(model, alias, operation, policy) {
     return new ExpressionTransformer(this.client).transform(policy.condition, {
-      model,
+      modelOrType: model,
+      thisType: model,
+      thisAlias: alias,
       alias,
       operation
     });