@zenstackhq/plugin-policy 3.0.0-beta.9 → 3.0.0

package/dist/index.d.cts

@@ -1,14 +1,14 @@
 import * as kysely from 'kysely';
-import * as _zenstackhq_runtime from '@zenstackhq/runtime';
-import { RuntimePlugin, OnKyselyQueryArgs } from '@zenstackhq/runtime';
-import { SchemaDef } from '@zenstackhq/runtime/schema';
+import * as _zenstackhq_orm from '@zenstackhq/orm';
+import { RuntimePlugin, OnKyselyQueryArgs } from '@zenstackhq/orm';
+import { SchemaDef } from '@zenstackhq/orm/schema';
 
 declare class PolicyPlugin<Schema extends SchemaDef> implements RuntimePlugin<Schema> {
     get id(): string;
     get name(): string;
     get description(): string;
     get functions(): {
-        check: _zenstackhq_runtime.ZModelFunction<any>;
+        check: _zenstackhq_orm.ZModelFunction<any>;
     };
     onKyselyQuery({ query, client, proceed }: OnKyselyQueryArgs<Schema>): Promise<kysely.QueryResult<any>>;
 }

package/dist/index.d.ts

@@ -1,14 +1,14 @@
 import * as kysely from 'kysely';
-import * as _zenstackhq_runtime from '@zenstackhq/runtime';
-import { RuntimePlugin, OnKyselyQueryArgs } from '@zenstackhq/runtime';
-import { SchemaDef } from '@zenstackhq/runtime/schema';
+import * as _zenstackhq_orm from '@zenstackhq/orm';
+import { RuntimePlugin, OnKyselyQueryArgs } from '@zenstackhq/orm';
+import { SchemaDef } from '@zenstackhq/orm/schema';
 
 declare class PolicyPlugin<Schema extends SchemaDef> implements RuntimePlugin<Schema> {
     get id(): string;
     get name(): string;
     get description(): string;
     get functions(): {
-        check: _zenstackhq_runtime.ZModelFunction<any>;
+        check: _zenstackhq_orm.ZModelFunction<any>;
     };
     onKyselyQuery({ query, client, proceed }: OnKyselyQueryArgs<Schema>): Promise<kysely.QueryResult<any>>;
 }

package/dist/index.js

@@ -3,20 +3,19 @@ var __name = (target, value) => __defProp(target, "name", { value, configurable:
 
 // src/functions.ts
 import { invariant as invariant4 } from "@zenstackhq/common-helpers";
-import { CRUD, QueryUtils as QueryUtils3 } from "@zenstackhq/runtime";
+import { CRUD, QueryUtils as QueryUtils3 } from "@zenstackhq/orm";
 import { ExpressionWrapper as ExpressionWrapper2, ValueNode as ValueNode4 } from "kysely";
 
 // src/policy-handler.ts
 import { invariant as invariant3 } from "@zenstackhq/common-helpers";
-import { getCrudDialect as getCrudDialect2, InternalError as InternalError2, QueryError as QueryError2, QueryUtils as QueryUtils2, RejectedByPolicyError, RejectedByPolicyReason } from "@zenstackhq/runtime";
-import { ExpressionUtils as ExpressionUtils4 } from "@zenstackhq/runtime/schema";
-import { ExpressionVisitor } from "@zenstackhq/sdk";
+import { getCrudDialect as getCrudDialect2, QueryUtils as QueryUtils2, RejectedByPolicyReason, SchemaUtils as SchemaUtils2 } from "@zenstackhq/orm";
+import { ExpressionUtils as ExpressionUtils4 } from "@zenstackhq/orm/schema";
 import { AliasNode as AliasNode3, BinaryOperationNode as BinaryOperationNode3, ColumnNode as ColumnNode2, DeleteQueryNode, expressionBuilder as expressionBuilder2, ExpressionWrapper, FromNode as FromNode2, FunctionNode as FunctionNode3, IdentifierNode as IdentifierNode2, InsertQueryNode, OperationNodeTransformer, OperatorNode as OperatorNode3, ParensNode as ParensNode2, PrimitiveValueListNode, RawNode, ReferenceNode as ReferenceNode3, ReturningNode, SelectAllNode, SelectionNode as SelectionNode2, SelectQueryNode as SelectQueryNode2, sql, TableNode as TableNode3, UpdateQueryNode, ValueListNode as ValueListNode2, ValueNode as ValueNode3, ValuesNode, WhereNode as WhereNode2 } from "kysely";
 import { match as match3 } from "ts-pattern";
 
 // src/column-collector.ts
-import { DefaultOperationNodeVisitor } from "@zenstackhq/sdk";
-var ColumnCollector = class extends DefaultOperationNodeVisitor {
+import { KyselyUtils } from "@zenstackhq/orm";
+var ColumnCollector = class extends KyselyUtils.DefaultOperationNodeVisitor {
   static {
     __name(this, "ColumnCollector");
   }
@@ -35,15 +34,15 @@ var ColumnCollector = class extends DefaultOperationNodeVisitor {
 
 // src/expression-transformer.ts
 import { invariant as invariant2 } from "@zenstackhq/common-helpers";
-import { getCrudDialect, InternalError, QueryError, QueryUtils } from "@zenstackhq/runtime";
-import { ExpressionUtils as ExpressionUtils3 } from "@zenstackhq/runtime/schema";
+import { getCrudDialect, QueryUtils, SchemaUtils } from "@zenstackhq/orm";
+import { ExpressionUtils as ExpressionUtils3 } from "@zenstackhq/orm/schema";
 import { AliasNode as AliasNode2, BinaryOperationNode as BinaryOperationNode2, ColumnNode, expressionBuilder, FromNode, FunctionNode as FunctionNode2, IdentifierNode, OperatorNode as OperatorNode2, ReferenceNode as ReferenceNode2, SelectionNode, SelectQueryNode, TableNode as TableNode2, ValueListNode, ValueNode as ValueNode2, WhereNode } from "kysely";
 import { match as match2 } from "ts-pattern";
 
 // src/expression-evaluator.ts
 import { invariant } from "@zenstackhq/common-helpers";
 import { match } from "ts-pattern";
-import { ExpressionUtils } from "@zenstackhq/runtime/schema";
+import { ExpressionUtils } from "@zenstackhq/orm/schema";
 var ExpressionEvaluator = class {
   static {
     __name(this, "ExpressionEvaluator");
@@ -84,6 +83,12 @@ var ExpressionEvaluator = class {
     }
     const left = this.evaluate(expr2.left, context);
     const right = this.evaluate(expr2.right, context);
+    if (![
+      "==",
+      "!="
+    ].includes(expr2.op) && (left === null || right === null)) {
+      return null;
+    }
     return match(expr2.op).with("==", () => left === right).with("!=", () => left !== right).with(">", () => left > right).with(">=", () => left >= right).with("<", () => left < right).with("<=", () => left <= right).with("&&", () => left && right).with("||", () => left || right).with("in", () => {
       const _right = right ?? [];
       invariant(Array.isArray(_right), 'expected array for "in" operator');
@@ -94,8 +99,8 @@ var ExpressionEvaluator = class {
     const op = expr2.op;
     invariant(op === "?" || op === "!" || op === "^", 'expected "?" or "!" or "^" operator');
     const left = this.evaluate(expr2.left, context);
-    if (!left) {
-      return false;
+    if (left === null || left === void 0) {
+      return null;
     }
     invariant(Array.isArray(left), "expected array");
     return match(op).with("?", () => left.some((item) => this.evaluate(expr2.right, {
@@ -111,8 +116,16 @@ var ExpressionEvaluator = class {
   }
 };
 
+// src/types.ts
+var CollectionPredicateOperator = [
+  "?",
+  "!",
+  "^"
+];
+
 // src/utils.ts
-import { ExpressionUtils as ExpressionUtils2 } from "@zenstackhq/runtime/schema";
+import { ORMError, ORMErrorReason } from "@zenstackhq/orm";
+import { ExpressionUtils as ExpressionUtils2 } from "@zenstackhq/orm/schema";
 import { AliasNode, AndNode, BinaryOperationNode, FunctionNode, OperatorNode, OrNode, ParensNode, ReferenceNode, TableNode, UnaryOperationNode, ValueNode } from "kysely";
 function trueNode(dialect) {
   return ValueNode.createImmediate(dialect.transformPrimitive(true, "Boolean", false));
@@ -213,6 +226,17 @@ function isBeforeInvocation(expr2) {
   return ExpressionUtils2.isCall(expr2) && expr2.function === "before";
 }
 __name(isBeforeInvocation, "isBeforeInvocation");
+function createRejectedByPolicyError(model, reason, message) {
+  const err = new ORMError(ORMErrorReason.REJECTED_BY_POLICY, message ?? "operation is rejected by access policies");
+  err.rejectedByPolicyReason = reason;
+  err.model = model;
+  return err;
+}
+__name(createRejectedByPolicyError, "createRejectedByPolicyError");
+function createUnsupportedError(message) {
+  return new ORMError(ORMErrorReason.NOT_SUPPORTED, message);
+}
+__name(createUnsupportedError, "createUnsupportedError");
 
 // src/expression-transformer.ts
 function _ts_decorate(decorators, target, key, desc) {
@@ -257,7 +281,7 @@ var ExpressionTransformer = class {
   }
   get authType() {
     if (!this.schema.authType) {
-      throw new InternalError('Schema does not have an "authType" specified');
+      invariant2(false, 'Schema does not have an "authType" specified');
     }
     return this.schema.authType;
   }
@@ -275,7 +299,11 @@ var ExpressionTransformer = class {
     return ValueListNode.create(expr2.items.map((item) => this.transform(item, context)));
   }
   _field(expr2, context) {
-    const fieldDef = QueryUtils.requireField(this.schema, context.model, expr2.field);
+    if (context.contextValue) {
+      const fieldDef2 = QueryUtils.requireField(this.schema, context.modelOrType, expr2.field);
+      return this.transformValue(context.contextValue[expr2.field], fieldDef2.type);
+    }
+    const fieldDef = QueryUtils.requireField(this.schema, context.modelOrType, expr2.field);
     if (!fieldDef.relation) {
       return this.createColumnRef(expr2.field, context);
     } else {
@@ -349,30 +377,39 @@ var ExpressionTransformer = class {
     }
   }
   transformNullCheck(expr2, operator) {
-    invariant2(operator === "==" || operator === "!=", 'operator must be "==" or "!=" for null comparison');
-    if (ValueNode2.is(expr2)) {
-      if (expr2.value === null) {
-        return operator === "==" ? trueNode(this.dialect) : falseNode(this.dialect);
+    if (operator === "==" || operator === "!=") {
+      if (ValueNode2.is(expr2)) {
+        if (expr2.value === null) {
+          return operator === "==" ? trueNode(this.dialect) : falseNode(this.dialect);
+        } else {
+          return operator === "==" ? falseNode(this.dialect) : trueNode(this.dialect);
+        }
       } else {
-        return operator === "==" ? falseNode(this.dialect) : trueNode(this.dialect);
+        return operator === "==" ? BinaryOperationNode2.create(expr2, OperatorNode2.create("is"), ValueNode2.createImmediate(null)) : BinaryOperationNode2.create(expr2, OperatorNode2.create("is not"), ValueNode2.createImmediate(null));
       }
     } else {
-      return operator === "==" ? BinaryOperationNode2.create(expr2, OperatorNode2.create("is"), ValueNode2.createImmediate(null)) : BinaryOperationNode2.create(expr2, OperatorNode2.create("is not"), ValueNode2.createImmediate(null));
+      return ValueNode2.createImmediate(null);
     }
   }
   normalizeBinaryOperationOperands(expr2, context) {
+    if (context.contextValue) {
+      return {
+        normalizedLeft: expr2.left,
+        normalizedRight: expr2.right
+      };
+    }
     let normalizedLeft = expr2.left;
-    if (this.isRelationField(expr2.left, context.model)) {
+    if (this.isRelationField(expr2.left, context.modelOrType)) {
       invariant2(ExpressionUtils3.isNull(expr2.right), "only null comparison is supported for relation field");
-      const leftRelDef = this.getFieldDefFromFieldRef(expr2.left, context.model);
+      const leftRelDef = this.getFieldDefFromFieldRef(expr2.left, context.modelOrType);
       invariant2(leftRelDef, "failed to get relation field definition");
       const idFields = QueryUtils.requireIdFields(this.schema, leftRelDef.type);
       normalizedLeft = this.makeOrAppendMember(normalizedLeft, idFields[0]);
     }
     let normalizedRight = expr2.right;
-    if (this.isRelationField(expr2.right, context.model)) {
+    if (this.isRelationField(expr2.right, context.modelOrType)) {
       invariant2(ExpressionUtils3.isNull(expr2.left), "only null comparison is supported for relation field");
-      const rightRelDef = this.getFieldDefFromFieldRef(expr2.right, context.model);
+      const rightRelDef = this.getFieldDefFromFieldRef(expr2.right, context.modelOrType);
       invariant2(rightRelDef, "failed to get relation field definition");
       const idFields = QueryUtils.requireIdFields(this.schema, rightRelDef.type);
       normalizedRight = this.makeOrAppendMember(normalizedRight, idFields[0]);
@@ -383,22 +420,30 @@ var ExpressionTransformer = class {
     };
   }
   transformCollectionPredicate(expr2, context) {
-    invariant2(expr2.op === "?" || expr2.op === "!" || expr2.op === "^", 'expected "?" or "!" or "^" operator');
-    if (this.isAuthCall(expr2.left) || this.isAuthMember(expr2.left)) {
-      const value = new ExpressionEvaluator().evaluate(expr2, {
+    this.ensureCollectionPredicateOperator(expr2.op);
+    if (this.isAuthMember(expr2.left) || context.contextValue) {
+      invariant2(ExpressionUtils3.isMember(expr2.left) || ExpressionUtils3.isField(expr2.left), "expected member or field expression");
+      const evaluator = new ExpressionEvaluator();
+      const receiver = evaluator.evaluate(expr2.left, {
+        thisValue: context.contextValue,
         auth: this.auth
       });
-      return this.transformValue(value, "Boolean");
+      const baseType = this.isAuthMember(expr2.left) ? this.authType : context.modelOrType;
+      const memberType = this.getMemberType(baseType, expr2.left);
+      return this.transformValueCollectionPredicate(receiver, expr2, {
+        ...context,
+        modelOrType: memberType
+      });
     }
     invariant2(ExpressionUtils3.isField(expr2.left) || ExpressionUtils3.isMember(expr2.left), "left operand must be field or member access");
     let newContextModel;
-    const fieldDef = this.getFieldDefFromFieldRef(expr2.left, context.model);
+    const fieldDef = this.getFieldDefFromFieldRef(expr2.left, context.modelOrType);
     if (fieldDef) {
       invariant2(fieldDef.relation, `field is not a relation: ${JSON.stringify(expr2.left)}`);
       newContextModel = fieldDef.type;
     } else {
       invariant2(ExpressionUtils3.isMember(expr2.left) && ExpressionUtils3.isField(expr2.left.receiver), "left operand must be member access with field receiver");
-      const fieldDef2 = QueryUtils.requireField(this.schema, context.model, expr2.left.receiver.field);
+      const fieldDef2 = QueryUtils.requireField(this.schema, context.modelOrType, expr2.left.receiver.field);
       newContextModel = fieldDef2.type;
       for (const member of expr2.left.members) {
         const memberDef = QueryUtils.requireField(this.schema, newContextModel, member);
@@ -407,7 +452,7 @@ var ExpressionTransformer = class {
     }
     let predicateFilter = this.transform(expr2.right, {
       ...context,
-      model: newContextModel,
+      modelOrType: newContextModel,
       alias: void 0
     });
     if (expr2.op === "!") {
@@ -423,9 +468,49 @@ var ExpressionTransformer = class {
       memberFilter: predicateFilter
     });
   }
+  ensureCollectionPredicateOperator(op) {
+    invariant2(CollectionPredicateOperator.includes(op), 'expected "?" or "!" or "^" operator');
+  }
+  transformValueCollectionPredicate(receiver, expr2, context) {
+    if (!receiver) {
+      return ValueNode2.createImmediate(null);
+    }
+    this.ensureCollectionPredicateOperator(expr2.op);
+    const visitor = new SchemaUtils.MatchingExpressionVisitor((e) => ExpressionUtils3.isThis(e));
+    if (!visitor.find(expr2.right)) {
+      const value = new ExpressionEvaluator().evaluate(expr2, {
+        auth: this.auth,
+        thisValue: context.contextValue
+      });
+      return this.transformValue(value, "Boolean");
+    } else {
+      invariant2(Array.isArray(receiver), "array value is expected");
+      const components = receiver.map((item) => this.transform(expr2.right, {
+        operation: context.operation,
+        thisType: context.thisType,
+        thisAlias: context.thisAlias,
+        modelOrType: context.modelOrType,
+        contextValue: item
+      }));
+      return match2(expr2.op).with("?", () => disjunction(this.dialect, components)).with("!", () => conjunction(this.dialect, components)).with("^", () => logicalNot(this.dialect, disjunction(this.dialect, components))).exhaustive();
+    }
+  }
+  getMemberType(receiverType, expr2) {
+    if (ExpressionUtils3.isField(expr2)) {
+      const fieldDef = QueryUtils.requireField(this.schema, receiverType, expr2.field);
+      return fieldDef.type;
+    } else {
+      let currType = receiverType;
+      for (const member of expr2.members) {
+        const fieldDef = QueryUtils.requireField(this.schema, currType, member);
+        currType = fieldDef.type;
+      }
+      return currType;
+    }
+  }
   transformAuthBinary(expr2, context) {
     if (expr2.op !== "==" && expr2.op !== "!=") {
-      throw new QueryError(`Unsupported operator for \`auth()\` in policy of model "${context.model}": ${expr2.op}`);
+      throw createUnsupportedError(`Unsupported operator for \`auth()\` in policy of model "${context.modelOrType}": ${expr2.op}`);
     }
     let authExpr;
     let other;
@@ -441,7 +526,7 @@ var ExpressionTransformer = class {
     } else {
       const authModel = QueryUtils.getModel(this.schema, this.authType);
       if (!authModel) {
-        throw new QueryError(`Unsupported use of \`auth()\` in policy of model "${context.model}", comparing with \`auth()\` is only possible when auth type is a model`);
+        throw createUnsupportedError(`Unsupported use of \`auth()\` in policy of model "${context.modelOrType}", comparing with \`auth()\` is only possible when auth type is a model`);
       }
       const idFields = Object.values(authModel.fields).filter((f) => f.id).map((f) => f.name);
       invariant2(idFields.length > 0, "auth type model must have at least one id field");
@@ -473,7 +558,12 @@ var ExpressionTransformer = class {
     } else if (value === false) {
       return falseNode(this.dialect);
     } else {
-      return ValueNode2.create(this.dialect.transformPrimitive(value, type, false) ?? null);
+      const transformed = this.dialect.transformPrimitive(value, type, false) ?? null;
+      if (!Array.isArray(transformed)) {
+        return ValueNode2.createImmediate(transformed);
+      } else {
+        return ValueNode2.create(transformed);
+      }
     }
   }
   _unary(expr2, context) {
@@ -491,14 +581,14 @@ var ExpressionTransformer = class {
   transformCall(expr2, context) {
     const func = this.getFunctionImpl(expr2.function);
     if (!func) {
-      throw new QueryError(`Function not implemented: ${expr2.function}`);
+      throw createUnsupportedError(`Function not implemented: ${expr2.function}`);
     }
     const eb = expressionBuilder();
     return func(eb, (expr2.args ?? []).map((arg) => this.transformCallArg(eb, arg, context)), {
       client: this.client,
       dialect: this.dialect,
-      model: context.model,
-      modelAlias: context.alias ?? context.model,
+      model: context.modelOrType,
+      modelAlias: context.alias ?? context.modelOrType,
       operation: context.operation
     });
   }
@@ -528,7 +618,7 @@ var ExpressionTransformer = class {
       const valNode = this.valueMemberAccess(this.auth, arg, this.authType);
       return valNode ? eb.val(valNode.value) : eb.val(null);
     }
-    throw new InternalError(`Unsupported argument expression: ${arg.kind}`);
+    throw createUnsupportedError(`Unsupported argument expression: ${arg.kind}`);
   }
   _member(expr2, context) {
     if (this.isAuthCall(expr2.receiver)) {
@@ -545,9 +635,15 @@ var ExpressionTransformer = class {
     const { memberFilter, memberSelect, ...restContext } = context;
     if (ExpressionUtils3.isThis(expr2.receiver)) {
       if (expr2.members.length === 1) {
-        return this._field(ExpressionUtils3.field(expr2.members[0]), context);
+        return this._field(ExpressionUtils3.field(expr2.members[0]), {
+          ...context,
+          alias: context.thisAlias,
+          modelOrType: context.thisType,
+          thisType: context.thisType,
+          contextValue: void 0
+        });
       } else {
-        const firstMemberFieldDef = QueryUtils.requireField(this.schema, context.model, expr2.members[0]);
+        const firstMemberFieldDef = QueryUtils.requireField(this.schema, context.thisType, expr2.members[0]);
         receiver = this.transformRelationAccess(expr2.members[0], firstMemberFieldDef.type, restContext);
         members = expr2.members.slice(1);
       }
@@ -557,10 +653,10 @@ var ExpressionTransformer = class {
     invariant2(SelectQueryNode.is(receiver), "expected receiver to be select query");
     let startType;
     if (ExpressionUtils3.isField(expr2.receiver)) {
-      const receiverField = QueryUtils.requireField(this.schema, context.model, expr2.receiver.field);
+      const receiverField = QueryUtils.requireField(this.schema, context.modelOrType, expr2.receiver.field);
       startType = receiverField.type;
     } else {
-      startType = context.model;
+      startType = context.thisType;
     }
     const memberFields = [];
     let currType = startType;
@@ -579,7 +675,7 @@ var ExpressionTransformer = class {
       if (fieldDef.relation) {
         const relation = this.transformRelationAccess(member, fieldDef.type, {
           ...restContext,
-          model: fromModel,
+          modelOrType: fromModel,
           alias: void 0
         });
         if (currNode) {
@@ -615,20 +711,29 @@ var ExpressionTransformer = class {
     if (!receiver) {
       return ValueNode2.createImmediate(null);
     }
-    if (expr2.members.length !== 1) {
-      throw new Error(`Only single member access is supported`);
+    invariant2(expr2.members.length > 0, "member expression must have at least one member");
+    let curr = receiver;
+    let currType = receiverType;
+    for (let i = 0; i < expr2.members.length; i++) {
+      const field = expr2.members[i];
+      curr = curr?.[field];
+      if (curr === void 0) {
+        curr = ValueNode2.createImmediate(null);
+        break;
+      }
+      currType = QueryUtils.requireField(this.schema, currType, field).type;
+      if (i === expr2.members.length - 1) {
+        curr = this.transformValue(curr, currType);
+      }
     }
-    const field = expr2.members[0];
-    const fieldDef = QueryUtils.requireField(this.schema, receiverType, field);
-    const fieldValue = receiver[field] ?? null;
-    return this.transformValue(fieldValue, fieldDef.type);
+    return curr;
   }
   transformRelationAccess(field, relationModel, context) {
-    const m2m = QueryUtils.getManyToManyRelation(this.schema, context.model, field);
+    const m2m = QueryUtils.getManyToManyRelation(this.schema, context.modelOrType, field);
     if (m2m) {
       return this.transformManyToManyRelationAccess(m2m, context);
     }
-    const fromModel = context.model;
+    const fromModel = context.modelOrType;
     const relationFieldDef = QueryUtils.requireField(this.schema, fromModel, field);
     const { keyPairs, ownedByModel } = QueryUtils.getRelationForeignKeyFieldPairs(this.schema, fromModel, field);
     let condition;
@@ -653,19 +758,19 @@ var ExpressionTransformer = class {
   }
   transformManyToManyRelationAccess(m2m, context) {
     const eb = expressionBuilder();
-    const relationQuery = eb.selectFrom(m2m.otherModel).innerJoin(m2m.joinTable, (join) => join.onRef(`${m2m.otherModel}.${m2m.otherPKName}`, "=", `${m2m.joinTable}.${m2m.otherFkName}`).onRef(`${m2m.joinTable}.${m2m.parentFkName}`, "=", `${context.alias ?? context.model}.${m2m.parentPKName}`));
+    const relationQuery = eb.selectFrom(m2m.otherModel).innerJoin(m2m.joinTable, (join) => join.onRef(`${m2m.otherModel}.${m2m.otherPKName}`, "=", `${m2m.joinTable}.${m2m.otherFkName}`).onRef(`${m2m.joinTable}.${m2m.parentFkName}`, "=", `${context.alias ?? context.modelOrType}.${m2m.parentPKName}`));
     return relationQuery.toOperationNode();
   }
   createColumnRef(column, context) {
-    const tableName = context.alias ?? context.model;
+    const tableName = context.alias ?? context.modelOrType;
     if (context.operation === "create") {
       return ReferenceNode2.create(ColumnNode.create(column), TableNode2.create(tableName));
     }
-    const fieldDef = QueryUtils.requireField(this.schema, context.model, column);
-    if (!fieldDef.originModel || fieldDef.originModel === context.model) {
+    const fieldDef = QueryUtils.requireField(this.schema, context.modelOrType, column);
+    if (!fieldDef.originModel || fieldDef.originModel === context.modelOrType) {
       return ReferenceNode2.create(ColumnNode.create(column), TableNode2.create(tableName));
     }
-    return this.buildDelegateBaseFieldSelect(context.model, tableName, column, fieldDef.originModel);
+    return this.buildDelegateBaseFieldSelect(context.modelOrType, tableName, column, fieldDef.originModel);
   }
   buildDelegateBaseFieldSelect(model, modelAlias, field, baseModel) {
     const idFields = QueryUtils.requireIdFields(this.client.$schema, model);
@@ -707,9 +812,9 @@ var ExpressionTransformer = class {
   }
   getFieldDefFromFieldRef(expr2, model) {
     if (ExpressionUtils3.isField(expr2)) {
-      return QueryUtils.requireField(this.schema, model, expr2.field);
+      return QueryUtils.getField(this.schema, model, expr2.field);
     } else if (ExpressionUtils3.isMember(expr2) && expr2.members.length === 1 && ExpressionUtils3.isThis(expr2.receiver)) {
-      return QueryUtils.requireField(this.schema, model, expr2.members[0]);
+      return QueryUtils.getField(this.schema, model, expr2.members[0]);
     } else {
       return void 0;
     }
@@ -800,12 +905,13 @@ var PolicyHandler = class extends OperationNodeTransformer {
   }
   async handle(node, proceed) {
     if (!this.isCrudQueryNode(node)) {
-      throw new RejectedByPolicyError(void 0, RejectedByPolicyReason.OTHER, "non-CRUD queries are not allowed");
+      throw createRejectedByPolicyError(void 0, RejectedByPolicyReason.OTHER, "non-CRUD queries are not allowed");
     }
     if (!this.isMutationQueryNode(node)) {
       return proceed(this.transformNode(node));
     }
     const { mutationModel } = this.getMutationModel(node);
+    this.tryRejectNonexistentModel(mutationModel);
     if (InsertQueryNode.is(node)) {
       const isManyToManyJoinTable = this.isManyToManyJoinTable(mutationModel);
       let needCheckPreCreate = true;
@@ -814,7 +920,7 @@ var PolicyHandler = class extends OperationNodeTransformer {
         if (constCondition === true) {
           needCheckPreCreate = false;
         } else if (constCondition === false) {
-          throw new RejectedByPolicyError(mutationModel);
+          throw createRejectedByPolicyError(mutationModel, RejectedByPolicyReason.NO_ACCESS);
         }
       }
       if (needCheckPreCreate) {
@@ -834,7 +940,7 @@ var PolicyHandler = class extends OperationNodeTransformer {
         for (const postRow of result.rows) {
           const beforeRow = beforeUpdateInfo.rows.find((r) => idFields.every((f) => r[f] === postRow[f]));
           if (!beforeRow) {
-            throw new QueryError2("Before-update and after-update rows do not match by id. If you have post-update policies on a model, updating id fields is not supported.");
+            throw createRejectedByPolicyError(mutationModel, RejectedByPolicyReason.OTHER, "Before-update and after-update rows do not match by id. If you have post-update policies on a model, updating id fields is not supported.");
           }
         }
       }
@@ -865,7 +971,7 @@ var PolicyHandler = class extends OperationNodeTransformer {
       }));
       const postUpdateResult = await proceed(postUpdateQuery.toOperationNode());
       if (!postUpdateResult.rows[0]?.$condition) {
-        throw new RejectedByPolicyError(mutationModel, RejectedByPolicyReason.NO_ACCESS, "some or all updated rows failed to pass post-update policy check");
+        throw createRejectedByPolicyError(mutationModel, RejectedByPolicyReason.NO_ACCESS, "some or all updated rows failed to pass post-update policy check");
       }
     }
     if (!node.returning || this.onlyReturningId(node)) {
@@ -873,7 +979,7 @@ var PolicyHandler = class extends OperationNodeTransformer {
     } else {
       const readBackResult = await this.processReadBack(node, result, proceed);
       if (readBackResult.rows.length !== result.rows.length) {
-        throw new RejectedByPolicyError(mutationModel, RejectedByPolicyReason.CANNOT_READ_BACK, "result is not allowed to be read back");
+        throw createRejectedByPolicyError(mutationModel, RejectedByPolicyReason.CANNOT_READ_BACK, "result is not allowed to be read back");
       }
       return readBackResult;
     }
@@ -927,7 +1033,7 @@ var PolicyHandler = class extends OperationNodeTransformer {
       return void 0;
     }
     const fields = /* @__PURE__ */ new Set();
-    const fieldCollector = new class extends ExpressionVisitor {
+    const fieldCollector = new class extends SchemaUtils2.ExpressionVisitor {
       visitMember(e) {
         if (isBeforeInvocation(e.receiver)) {
           invariant3(e.members.length === 1, "before() can only be followed by a scalar field access");
@@ -972,6 +1078,7 @@ var PolicyHandler = class extends OperationNodeTransformer {
     if (!table) {
       return super.transformJoin(node);
     }
+    this.tryRejectNonexistentModel(table.model);
     const filter = this.buildPolicyFilter(table.model, table.alias, "read");
     const nestedSelect = {
       kind: "SelectQueryNode",
@@ -1132,10 +1239,10 @@ var PolicyHandler = class extends OperationNodeTransformer {
     };
     const result = await proceed(queryNode);
     if (!result.rows[0]?.$conditionA) {
-      throw new RejectedByPolicyError(m2m.firstModel, RejectedByPolicyReason.CANNOT_READ_BACK, `many-to-many relation participant model "${m2m.firstModel}" not updatable`);
+      throw createRejectedByPolicyError(m2m.firstModel, RejectedByPolicyReason.CANNOT_READ_BACK, `many-to-many relation participant model "${m2m.firstModel}" not updatable`);
     }
     if (!result.rows[0]?.$conditionB) {
-      throw new RejectedByPolicyError(m2m.secondModel, RejectedByPolicyReason.NO_ACCESS, `many-to-many relation participant model "${m2m.secondModel}" not updatable`);
+      throw createRejectedByPolicyError(m2m.secondModel, RejectedByPolicyReason.NO_ACCESS, `many-to-many relation participant model "${m2m.secondModel}" not updatable`);
     }
   }
   async enforcePreCreatePolicyForOne(model, fields, values, proceed) {
@@ -1177,7 +1284,7 @@ var PolicyHandler = class extends OperationNodeTransformer {
     };
     const result = await proceed(preCreateCheck);
     if (!result.rows[0]?.$condition) {
-      throw new RejectedByPolicyError(model);
+      throw createRejectedByPolicyError(model, RejectedByPolicyReason.NO_ACCESS);
     }
   }
   unwrapCreateValueRows(node, model, fields, isManyToManyJoinTable) {
@@ -1188,7 +1295,7 @@ var PolicyHandler = class extends OperationNodeTransformer {
         this.unwrapCreateValueRow(node.values, model, fields, isManyToManyJoinTable)
       ];
     } else {
-      throw new InternalError2(`Unexpected node kind: ${node.kind} for unwrapping create values`);
+      invariant3(false, `Unexpected node kind: ${node.kind} for unwrapping create values`);
     }
   }
   unwrapCreateValueRow(data, model, fields, isImplicitManyToManyJoinTable) {
@@ -1279,7 +1386,7 @@ var PolicyHandler = class extends OperationNodeTransformer {
       alias: void 0
     })).when(UpdateQueryNode.is, (node2) => {
       if (!node2.table) {
-        throw new QueryError2("Update query must have a table");
+        invariant3(false, "Update query must have a table");
       }
       const r2 = this.extractTableName(node2.table);
       return r2 ? {
@@ -1288,7 +1395,7 @@ var PolicyHandler = class extends OperationNodeTransformer {
       } : void 0;
     }).when(DeleteQueryNode.is, (node2) => {
       if (node2.from.froms.length !== 1) {
-        throw new QueryError2("Only one from table is supported for delete");
+        throw createUnsupportedError("Only one from table is supported for delete");
       }
       const r2 = this.extractTableName(node2.from.froms[0]);
       return r2 ? {
@@ -1297,7 +1404,7 @@ var PolicyHandler = class extends OperationNodeTransformer {
       } : void 0;
     }).exhaustive();
     if (!r) {
-      throw new InternalError2(`Unable to get table name for query node: ${node}`);
+      invariant3(false, `Unable to get table name for query node: ${node}`);
     }
     return r;
   }
@@ -1364,6 +1471,7 @@ var PolicyHandler = class extends OperationNodeTransformer {
       const extractResult = this.extractTableName(table);
       if (extractResult) {
         const { model, alias } = extractResult;
+        this.tryRejectNonexistentModel(model);
         const filter = this.buildPolicyFilter(model, alias, "read");
         return acc ? conjunction(this.dialect, [
           acc,
@@ -1375,7 +1483,9 @@ var PolicyHandler = class extends OperationNodeTransformer {
   }
   compilePolicyCondition(model, alias, operation, policy) {
     return new ExpressionTransformer(this.client).transform(policy.condition, {
-      model,
+      modelOrType: model,
+      thisType: model,
+      thisAlias: alias,
       alias,
       operation
     });
@@ -1449,6 +1559,11 @@ var PolicyHandler = class extends OperationNodeTransformer {
       bQuery
     ]).toOperationNode();
   }
+  tryRejectNonexistentModel(model) {
+    if (!QueryUtils2.hasModel(this.client.$schema, model) && !this.isManyToManyJoinTable(model)) {
+      throw createRejectedByPolicyError(model, RejectedByPolicyReason.NO_ACCESS);
+    }
+  }
 };
 
 // src/functions.ts