@zenstackhq/plugin-policy 3.0.0-beta.29 → 3.0.0-beta.31

package/dist/index.cjs

@@ -935,6 +935,7 @@ var PolicyHandler = class extends import_kysely3.OperationNodeTransformer {
       return proceed(this.transformNode(node));
     }
     const { mutationModel } = this.getMutationModel(node);
+    this.tryRejectNonexistentModel(mutationModel);
     if (import_kysely3.InsertQueryNode.is(node)) {
       const isManyToManyJoinTable = this.isManyToManyJoinTable(mutationModel);
       let needCheckPreCreate = true;
@@ -1101,6 +1102,7 @@ var PolicyHandler = class extends import_kysely3.OperationNodeTransformer {
     if (!table) {
       return super.transformJoin(node);
     }
+    this.tryRejectNonexistentModel(table.model);
     const filter = this.buildPolicyFilter(table.model, table.alias, "read");
     const nestedSelect = {
       kind: "SelectQueryNode",
@@ -1493,6 +1495,7 @@ var PolicyHandler = class extends import_kysely3.OperationNodeTransformer {
       const extractResult = this.extractTableName(table);
       if (extractResult) {
         const { model, alias } = extractResult;
+        this.tryRejectNonexistentModel(model);
         const filter = this.buildPolicyFilter(model, alias, "read");
         return acc ? conjunction(this.dialect, [
           acc,
@@ -1580,6 +1583,11 @@ var PolicyHandler = class extends import_kysely3.OperationNodeTransformer {
       bQuery
     ]).toOperationNode();
   }
+  tryRejectNonexistentModel(model) {
+    if (!import_orm4.QueryUtils.hasModel(this.client.$schema, model) && !this.isManyToManyJoinTable(model)) {
+      throw createRejectedByPolicyError(model, import_orm4.RejectedByPolicyReason.NO_ACCESS);
+    }
+  }
 };
 
 // src/functions.ts