@zenstackhq/plugin-policy 3.0.0-beta.25 → 3.0.0-beta.27

package/dist/index.js

@@ -8,7 +8,7 @@ import { ExpressionWrapper as ExpressionWrapper2, ValueNode as ValueNode4 } from
 
 // src/policy-handler.ts
 import { invariant as invariant3 } from "@zenstackhq/common-helpers";
-import { getCrudDialect as getCrudDialect2, QueryUtils as QueryUtils2, RejectedByPolicyReason, SchemaUtils } from "@zenstackhq/orm";
+import { getCrudDialect as getCrudDialect2, QueryUtils as QueryUtils2, RejectedByPolicyReason, SchemaUtils as SchemaUtils2 } from "@zenstackhq/orm";
 import { ExpressionUtils as ExpressionUtils4 } from "@zenstackhq/orm/schema";
 import { AliasNode as AliasNode3, BinaryOperationNode as BinaryOperationNode3, ColumnNode as ColumnNode2, DeleteQueryNode, expressionBuilder as expressionBuilder2, ExpressionWrapper, FromNode as FromNode2, FunctionNode as FunctionNode3, IdentifierNode as IdentifierNode2, InsertQueryNode, OperationNodeTransformer, OperatorNode as OperatorNode3, ParensNode as ParensNode2, PrimitiveValueListNode, RawNode, ReferenceNode as ReferenceNode3, ReturningNode, SelectAllNode, SelectionNode as SelectionNode2, SelectQueryNode as SelectQueryNode2, sql, TableNode as TableNode3, UpdateQueryNode, ValueListNode as ValueListNode2, ValueNode as ValueNode3, ValuesNode, WhereNode as WhereNode2 } from "kysely";
 import { match as match3 } from "ts-pattern";
@@ -34,7 +34,7 @@ var ColumnCollector = class extends KyselyUtils.DefaultOperationNodeVisitor {
 
 // src/expression-transformer.ts
 import { invariant as invariant2 } from "@zenstackhq/common-helpers";
-import { getCrudDialect, QueryUtils } from "@zenstackhq/orm";
+import { getCrudDialect, QueryUtils, SchemaUtils } from "@zenstackhq/orm";
 import { ExpressionUtils as ExpressionUtils3 } from "@zenstackhq/orm/schema";
 import { AliasNode as AliasNode2, BinaryOperationNode as BinaryOperationNode2, ColumnNode, expressionBuilder, FromNode, FunctionNode as FunctionNode2, IdentifierNode, OperatorNode as OperatorNode2, ReferenceNode as ReferenceNode2, SelectionNode, SelectQueryNode, TableNode as TableNode2, ValueListNode, ValueNode as ValueNode2, WhereNode } from "kysely";
 import { match as match2 } from "ts-pattern";
@@ -83,6 +83,12 @@ var ExpressionEvaluator = class {
     }
     const left = this.evaluate(expr2.left, context);
     const right = this.evaluate(expr2.right, context);
+    if (![
+      "==",
+      "!="
+    ].includes(expr2.op) && (left === null || right === null)) {
+      return null;
+    }
     return match(expr2.op).with("==", () => left === right).with("!=", () => left !== right).with(">", () => left > right).with(">=", () => left >= right).with("<", () => left < right).with("<=", () => left <= right).with("&&", () => left && right).with("||", () => left || right).with("in", () => {
       const _right = right ?? [];
       invariant(Array.isArray(_right), 'expected array for "in" operator');
@@ -93,8 +99,8 @@ var ExpressionEvaluator = class {
     const op = expr2.op;
     invariant(op === "?" || op === "!" || op === "^", 'expected "?" or "!" or "^" operator');
     const left = this.evaluate(expr2.left, context);
-    if (!left) {
-      return false;
+    if (left === null || left === void 0) {
+      return null;
     }
     invariant(Array.isArray(left), "expected array");
     return match(op).with("?", () => left.some((item) => this.evaluate(expr2.right, {
@@ -110,6 +116,13 @@ var ExpressionEvaluator = class {
   }
 };
 
+// src/types.ts
+var CollectionPredicateOperator = [
+  "?",
+  "!",
+  "^"
+];
+
 // src/utils.ts
 import { ORMError, ORMErrorReason } from "@zenstackhq/orm";
 import { ExpressionUtils as ExpressionUtils2 } from "@zenstackhq/orm/schema";
@@ -286,7 +299,11 @@ var ExpressionTransformer = class {
     return ValueListNode.create(expr2.items.map((item) => this.transform(item, context)));
   }
   _field(expr2, context) {
-    const fieldDef = QueryUtils.requireField(this.schema, context.model, expr2.field);
+    if (context.contextValue) {
+      const fieldDef2 = QueryUtils.requireField(this.schema, context.modelOrType, expr2.field);
+      return this.transformValue(context.contextValue[expr2.field], fieldDef2.type);
+    }
+    const fieldDef = QueryUtils.requireField(this.schema, context.modelOrType, expr2.field);
     if (!fieldDef.relation) {
       return this.createColumnRef(expr2.field, context);
     } else {
@@ -360,30 +377,39 @@ var ExpressionTransformer = class {
     }
   }
   transformNullCheck(expr2, operator) {
-    invariant2(operator === "==" || operator === "!=", 'operator must be "==" or "!=" for null comparison');
-    if (ValueNode2.is(expr2)) {
-      if (expr2.value === null) {
-        return operator === "==" ? trueNode(this.dialect) : falseNode(this.dialect);
+    if (operator === "==" || operator === "!=") {
+      if (ValueNode2.is(expr2)) {
+        if (expr2.value === null) {
+          return operator === "==" ? trueNode(this.dialect) : falseNode(this.dialect);
+        } else {
+          return operator === "==" ? falseNode(this.dialect) : trueNode(this.dialect);
+        }
       } else {
-        return operator === "==" ? falseNode(this.dialect) : trueNode(this.dialect);
+        return operator === "==" ? BinaryOperationNode2.create(expr2, OperatorNode2.create("is"), ValueNode2.createImmediate(null)) : BinaryOperationNode2.create(expr2, OperatorNode2.create("is not"), ValueNode2.createImmediate(null));
       }
     } else {
-      return operator === "==" ? BinaryOperationNode2.create(expr2, OperatorNode2.create("is"), ValueNode2.createImmediate(null)) : BinaryOperationNode2.create(expr2, OperatorNode2.create("is not"), ValueNode2.createImmediate(null));
+      return ValueNode2.createImmediate(null);
     }
   }
   normalizeBinaryOperationOperands(expr2, context) {
+    if (context.contextValue) {
+      return {
+        normalizedLeft: expr2.left,
+        normalizedRight: expr2.right
+      };
+    }
     let normalizedLeft = expr2.left;
-    if (this.isRelationField(expr2.left, context.model)) {
+    if (this.isRelationField(expr2.left, context.modelOrType)) {
       invariant2(ExpressionUtils3.isNull(expr2.right), "only null comparison is supported for relation field");
-      const leftRelDef = this.getFieldDefFromFieldRef(expr2.left, context.model);
+      const leftRelDef = this.getFieldDefFromFieldRef(expr2.left, context.modelOrType);
       invariant2(leftRelDef, "failed to get relation field definition");
       const idFields = QueryUtils.requireIdFields(this.schema, leftRelDef.type);
       normalizedLeft = this.makeOrAppendMember(normalizedLeft, idFields[0]);
     }
     let normalizedRight = expr2.right;
-    if (this.isRelationField(expr2.right, context.model)) {
+    if (this.isRelationField(expr2.right, context.modelOrType)) {
       invariant2(ExpressionUtils3.isNull(expr2.left), "only null comparison is supported for relation field");
-      const rightRelDef = this.getFieldDefFromFieldRef(expr2.right, context.model);
+      const rightRelDef = this.getFieldDefFromFieldRef(expr2.right, context.modelOrType);
       invariant2(rightRelDef, "failed to get relation field definition");
       const idFields = QueryUtils.requireIdFields(this.schema, rightRelDef.type);
       normalizedRight = this.makeOrAppendMember(normalizedRight, idFields[0]);
@@ -394,22 +420,30 @@ var ExpressionTransformer = class {
     };
   }
   transformCollectionPredicate(expr2, context) {
-    invariant2(expr2.op === "?" || expr2.op === "!" || expr2.op === "^", 'expected "?" or "!" or "^" operator');
-    if (this.isAuthCall(expr2.left) || this.isAuthMember(expr2.left)) {
-      const value = new ExpressionEvaluator().evaluate(expr2, {
+    this.ensureCollectionPredicateOperator(expr2.op);
+    if (this.isAuthMember(expr2.left) || context.contextValue) {
+      invariant2(ExpressionUtils3.isMember(expr2.left) || ExpressionUtils3.isField(expr2.left), "expected member or field expression");
+      const evaluator = new ExpressionEvaluator();
+      const receiver = evaluator.evaluate(expr2.left, {
+        thisValue: context.contextValue,
         auth: this.auth
       });
-      return this.transformValue(value, "Boolean");
+      const baseType = this.isAuthMember(expr2.left) ? this.authType : context.modelOrType;
+      const memberType = this.getMemberType(baseType, expr2.left);
+      return this.transformValueCollectionPredicate(receiver, expr2, {
+        ...context,
+        modelOrType: memberType
+      });
     }
     invariant2(ExpressionUtils3.isField(expr2.left) || ExpressionUtils3.isMember(expr2.left), "left operand must be field or member access");
     let newContextModel;
-    const fieldDef = this.getFieldDefFromFieldRef(expr2.left, context.model);
+    const fieldDef = this.getFieldDefFromFieldRef(expr2.left, context.modelOrType);
     if (fieldDef) {
       invariant2(fieldDef.relation, `field is not a relation: ${JSON.stringify(expr2.left)}`);
       newContextModel = fieldDef.type;
     } else {
       invariant2(ExpressionUtils3.isMember(expr2.left) && ExpressionUtils3.isField(expr2.left.receiver), "left operand must be member access with field receiver");
-      const fieldDef2 = QueryUtils.requireField(this.schema, context.model, expr2.left.receiver.field);
+      const fieldDef2 = QueryUtils.requireField(this.schema, context.modelOrType, expr2.left.receiver.field);
       newContextModel = fieldDef2.type;
       for (const member of expr2.left.members) {
         const memberDef = QueryUtils.requireField(this.schema, newContextModel, member);
@@ -418,7 +452,7 @@ var ExpressionTransformer = class {
     }
     let predicateFilter = this.transform(expr2.right, {
       ...context,
-      model: newContextModel,
+      modelOrType: newContextModel,
       alias: void 0
     });
     if (expr2.op === "!") {
@@ -434,9 +468,49 @@ var ExpressionTransformer = class {
       memberFilter: predicateFilter
     });
   }
+  ensureCollectionPredicateOperator(op) {
+    invariant2(CollectionPredicateOperator.includes(op), 'expected "?" or "!" or "^" operator');
+  }
+  transformValueCollectionPredicate(receiver, expr2, context) {
+    if (!receiver) {
+      return ValueNode2.createImmediate(null);
+    }
+    this.ensureCollectionPredicateOperator(expr2.op);
+    const visitor = new SchemaUtils.MatchingExpressionVisitor((e) => ExpressionUtils3.isThis(e));
+    if (!visitor.find(expr2.right)) {
+      const value = new ExpressionEvaluator().evaluate(expr2, {
+        auth: this.auth,
+        thisValue: context.contextValue
+      });
+      return this.transformValue(value, "Boolean");
+    } else {
+      invariant2(Array.isArray(receiver), "array value is expected");
+      const components = receiver.map((item) => this.transform(expr2.right, {
+        operation: context.operation,
+        thisType: context.thisType,
+        thisAlias: context.thisAlias,
+        modelOrType: context.modelOrType,
+        contextValue: item
+      }));
+      return match2(expr2.op).with("?", () => disjunction(this.dialect, components)).with("!", () => conjunction(this.dialect, components)).with("^", () => logicalNot(this.dialect, disjunction(this.dialect, components))).exhaustive();
+    }
+  }
+  getMemberType(receiverType, expr2) {
+    if (ExpressionUtils3.isField(expr2)) {
+      const fieldDef = QueryUtils.requireField(this.schema, receiverType, expr2.field);
+      return fieldDef.type;
+    } else {
+      let currType = receiverType;
+      for (const member of expr2.members) {
+        const fieldDef = QueryUtils.requireField(this.schema, currType, member);
+        currType = fieldDef.type;
+      }
+      return currType;
+    }
+  }
   transformAuthBinary(expr2, context) {
     if (expr2.op !== "==" && expr2.op !== "!=") {
-      throw createUnsupportedError(`Unsupported operator for \`auth()\` in policy of model "${context.model}": ${expr2.op}`);
+      throw createUnsupportedError(`Unsupported operator for \`auth()\` in policy of model "${context.modelOrType}": ${expr2.op}`);
     }
     let authExpr;
     let other;
@@ -452,7 +526,7 @@ var ExpressionTransformer = class {
     } else {
       const authModel = QueryUtils.getModel(this.schema, this.authType);
       if (!authModel) {
-        throw createUnsupportedError(`Unsupported use of \`auth()\` in policy of model "${context.model}", comparing with \`auth()\` is only possible when auth type is a model`);
+        throw createUnsupportedError(`Unsupported use of \`auth()\` in policy of model "${context.modelOrType}", comparing with \`auth()\` is only possible when auth type is a model`);
       }
       const idFields = Object.values(authModel.fields).filter((f) => f.id).map((f) => f.name);
       invariant2(idFields.length > 0, "auth type model must have at least one id field");
@@ -484,7 +558,12 @@ var ExpressionTransformer = class {
     } else if (value === false) {
       return falseNode(this.dialect);
     } else {
-      return ValueNode2.create(this.dialect.transformPrimitive(value, type, false) ?? null);
+      const transformed = this.dialect.transformPrimitive(value, type, false) ?? null;
+      if (!Array.isArray(transformed)) {
+        return ValueNode2.createImmediate(transformed);
+      } else {
+        return ValueNode2.create(transformed);
+      }
     }
   }
   _unary(expr2, context) {
@@ -508,8 +587,8 @@ var ExpressionTransformer = class {
     return func(eb, (expr2.args ?? []).map((arg) => this.transformCallArg(eb, arg, context)), {
       client: this.client,
       dialect: this.dialect,
-      model: context.model,
-      modelAlias: context.alias ?? context.model,
+      model: context.modelOrType,
+      modelAlias: context.alias ?? context.modelOrType,
       operation: context.operation
     });
   }
@@ -556,9 +635,15 @@ var ExpressionTransformer = class {
     const { memberFilter, memberSelect, ...restContext } = context;
     if (ExpressionUtils3.isThis(expr2.receiver)) {
       if (expr2.members.length === 1) {
-        return this._field(ExpressionUtils3.field(expr2.members[0]), context);
+        return this._field(ExpressionUtils3.field(expr2.members[0]), {
+          ...context,
+          alias: context.thisAlias,
+          modelOrType: context.thisType,
+          thisType: context.thisType,
+          contextValue: void 0
+        });
       } else {
-        const firstMemberFieldDef = QueryUtils.requireField(this.schema, context.model, expr2.members[0]);
+        const firstMemberFieldDef = QueryUtils.requireField(this.schema, context.thisType, expr2.members[0]);
         receiver = this.transformRelationAccess(expr2.members[0], firstMemberFieldDef.type, restContext);
         members = expr2.members.slice(1);
       }
@@ -568,10 +653,10 @@ var ExpressionTransformer = class {
     invariant2(SelectQueryNode.is(receiver), "expected receiver to be select query");
     let startType;
     if (ExpressionUtils3.isField(expr2.receiver)) {
-      const receiverField = QueryUtils.requireField(this.schema, context.model, expr2.receiver.field);
+      const receiverField = QueryUtils.requireField(this.schema, context.modelOrType, expr2.receiver.field);
       startType = receiverField.type;
     } else {
-      startType = context.model;
+      startType = context.thisType;
     }
     const memberFields = [];
     let currType = startType;
@@ -590,7 +675,7 @@ var ExpressionTransformer = class {
       if (fieldDef.relation) {
         const relation = this.transformRelationAccess(member, fieldDef.type, {
           ...restContext,
-          model: fromModel,
+          modelOrType: fromModel,
           alias: void 0
         });
         if (currNode) {
@@ -626,20 +711,29 @@ var ExpressionTransformer = class {
     if (!receiver) {
       return ValueNode2.createImmediate(null);
     }
-    if (expr2.members.length !== 1) {
-      throw new Error(`Only single member access is supported`);
+    invariant2(expr2.members.length > 0, "member expression must have at least one member");
+    let curr = receiver;
+    let currType = receiverType;
+    for (let i = 0; i < expr2.members.length; i++) {
+      const field = expr2.members[i];
+      curr = curr?.[field];
+      if (curr === void 0) {
+        curr = ValueNode2.createImmediate(null);
+        break;
+      }
+      currType = QueryUtils.requireField(this.schema, currType, field).type;
+      if (i === expr2.members.length - 1) {
+        curr = this.transformValue(curr, currType);
+      }
     }
-    const field = expr2.members[0];
-    const fieldDef = QueryUtils.requireField(this.schema, receiverType, field);
-    const fieldValue = receiver[field] ?? null;
-    return this.transformValue(fieldValue, fieldDef.type);
+    return curr;
   }
   transformRelationAccess(field, relationModel, context) {
-    const m2m = QueryUtils.getManyToManyRelation(this.schema, context.model, field);
+    const m2m = QueryUtils.getManyToManyRelation(this.schema, context.modelOrType, field);
     if (m2m) {
       return this.transformManyToManyRelationAccess(m2m, context);
     }
-    const fromModel = context.model;
+    const fromModel = context.modelOrType;
     const relationFieldDef = QueryUtils.requireField(this.schema, fromModel, field);
     const { keyPairs, ownedByModel } = QueryUtils.getRelationForeignKeyFieldPairs(this.schema, fromModel, field);
     let condition;
@@ -664,19 +758,19 @@ var ExpressionTransformer = class {
   }
   transformManyToManyRelationAccess(m2m, context) {
     const eb = expressionBuilder();
-    const relationQuery = eb.selectFrom(m2m.otherModel).innerJoin(m2m.joinTable, (join) => join.onRef(`${m2m.otherModel}.${m2m.otherPKName}`, "=", `${m2m.joinTable}.${m2m.otherFkName}`).onRef(`${m2m.joinTable}.${m2m.parentFkName}`, "=", `${context.alias ?? context.model}.${m2m.parentPKName}`));
+    const relationQuery = eb.selectFrom(m2m.otherModel).innerJoin(m2m.joinTable, (join) => join.onRef(`${m2m.otherModel}.${m2m.otherPKName}`, "=", `${m2m.joinTable}.${m2m.otherFkName}`).onRef(`${m2m.joinTable}.${m2m.parentFkName}`, "=", `${context.alias ?? context.modelOrType}.${m2m.parentPKName}`));
     return relationQuery.toOperationNode();
   }
   createColumnRef(column, context) {
-    const tableName = context.alias ?? context.model;
+    const tableName = context.alias ?? context.modelOrType;
     if (context.operation === "create") {
       return ReferenceNode2.create(ColumnNode.create(column), TableNode2.create(tableName));
     }
-    const fieldDef = QueryUtils.requireField(this.schema, context.model, column);
-    if (!fieldDef.originModel || fieldDef.originModel === context.model) {
+    const fieldDef = QueryUtils.requireField(this.schema, context.modelOrType, column);
+    if (!fieldDef.originModel || fieldDef.originModel === context.modelOrType) {
       return ReferenceNode2.create(ColumnNode.create(column), TableNode2.create(tableName));
     }
-    return this.buildDelegateBaseFieldSelect(context.model, tableName, column, fieldDef.originModel);
+    return this.buildDelegateBaseFieldSelect(context.modelOrType, tableName, column, fieldDef.originModel);
   }
   buildDelegateBaseFieldSelect(model, modelAlias, field, baseModel) {
     const idFields = QueryUtils.requireIdFields(this.client.$schema, model);
@@ -718,9 +812,9 @@ var ExpressionTransformer = class {
   }
   getFieldDefFromFieldRef(expr2, model) {
     if (ExpressionUtils3.isField(expr2)) {
-      return QueryUtils.requireField(this.schema, model, expr2.field);
+      return QueryUtils.getField(this.schema, model, expr2.field);
     } else if (ExpressionUtils3.isMember(expr2) && expr2.members.length === 1 && ExpressionUtils3.isThis(expr2.receiver)) {
-      return QueryUtils.requireField(this.schema, model, expr2.members[0]);
+      return QueryUtils.getField(this.schema, model, expr2.members[0]);
     } else {
       return void 0;
     }
@@ -938,7 +1032,7 @@ var PolicyHandler = class extends OperationNodeTransformer {
       return void 0;
     }
     const fields = /* @__PURE__ */ new Set();
-    const fieldCollector = new class extends SchemaUtils.ExpressionVisitor {
+    const fieldCollector = new class extends SchemaUtils2.ExpressionVisitor {
       visitMember(e) {
         if (isBeforeInvocation(e.receiver)) {
           invariant3(e.members.length === 1, "before() can only be followed by a scalar field access");
@@ -1386,7 +1480,9 @@ var PolicyHandler = class extends OperationNodeTransformer {
   }
   compilePolicyCondition(model, alias, operation, policy) {
     return new ExpressionTransformer(this.client).transform(policy.condition, {
-      model,
+      modelOrType: model,
+      thisType: model,
+      thisAlias: alias,
       alias,
       operation
     });