@zenstackhq/plugin-policy 3.0.0-beta.9

package/dist/index.js

@@ -0,0 +1,1531 @@
+var __defProp = Object.defineProperty;
+var __name = (target, value) => __defProp(target, "name", { value, configurable: true });
+
+// src/functions.ts
+import { invariant as invariant4 } from "@zenstackhq/common-helpers";
+import { CRUD, QueryUtils as QueryUtils3 } from "@zenstackhq/runtime";
+import { ExpressionWrapper as ExpressionWrapper2, ValueNode as ValueNode4 } from "kysely";
+
+// src/policy-handler.ts
+import { invariant as invariant3 } from "@zenstackhq/common-helpers";
+import { getCrudDialect as getCrudDialect2, InternalError as InternalError2, QueryError as QueryError2, QueryUtils as QueryUtils2, RejectedByPolicyError, RejectedByPolicyReason } from "@zenstackhq/runtime";
+import { ExpressionUtils as ExpressionUtils4 } from "@zenstackhq/runtime/schema";
+import { ExpressionVisitor } from "@zenstackhq/sdk";
+import { AliasNode as AliasNode3, BinaryOperationNode as BinaryOperationNode3, ColumnNode as ColumnNode2, DeleteQueryNode, expressionBuilder as expressionBuilder2, ExpressionWrapper, FromNode as FromNode2, FunctionNode as FunctionNode3, IdentifierNode as IdentifierNode2, InsertQueryNode, OperationNodeTransformer, OperatorNode as OperatorNode3, ParensNode as ParensNode2, PrimitiveValueListNode, RawNode, ReferenceNode as ReferenceNode3, ReturningNode, SelectAllNode, SelectionNode as SelectionNode2, SelectQueryNode as SelectQueryNode2, sql, TableNode as TableNode3, UpdateQueryNode, ValueListNode as ValueListNode2, ValueNode as ValueNode3, ValuesNode, WhereNode as WhereNode2 } from "kysely";
+import { match as match3 } from "ts-pattern";
+
+// src/column-collector.ts
+import { DefaultOperationNodeVisitor } from "@zenstackhq/sdk";
+var ColumnCollector = class extends DefaultOperationNodeVisitor {
+  static {
+    __name(this, "ColumnCollector");
+  }
+  columns = [];
+  collect(node) {
+    this.columns = [];
+    this.visitNode(node);
+    return this.columns;
+  }
+  visitColumn(node) {
+    if (!this.columns.includes(node.column.name)) {
+      this.columns.push(node.column.name);
+    }
+  }
+};
+
+// src/expression-transformer.ts
+import { invariant as invariant2 } from "@zenstackhq/common-helpers";
+import { getCrudDialect, InternalError, QueryError, QueryUtils } from "@zenstackhq/runtime";
+import { ExpressionUtils as ExpressionUtils3 } from "@zenstackhq/runtime/schema";
+import { AliasNode as AliasNode2, BinaryOperationNode as BinaryOperationNode2, ColumnNode, expressionBuilder, FromNode, FunctionNode as FunctionNode2, IdentifierNode, OperatorNode as OperatorNode2, ReferenceNode as ReferenceNode2, SelectionNode, SelectQueryNode, TableNode as TableNode2, ValueListNode, ValueNode as ValueNode2, WhereNode } from "kysely";
+import { match as match2 } from "ts-pattern";
+
+// src/expression-evaluator.ts
+import { invariant } from "@zenstackhq/common-helpers";
+import { match } from "ts-pattern";
+import { ExpressionUtils } from "@zenstackhq/runtime/schema";
+var ExpressionEvaluator = class {
+  static {
+    __name(this, "ExpressionEvaluator");
+  }
+  evaluate(expression, context) {
+    const result = match(expression).when(ExpressionUtils.isArray, (expr2) => this.evaluateArray(expr2, context)).when(ExpressionUtils.isBinary, (expr2) => this.evaluateBinary(expr2, context)).when(ExpressionUtils.isField, (expr2) => this.evaluateField(expr2, context)).when(ExpressionUtils.isLiteral, (expr2) => this.evaluateLiteral(expr2)).when(ExpressionUtils.isMember, (expr2) => this.evaluateMember(expr2, context)).when(ExpressionUtils.isUnary, (expr2) => this.evaluateUnary(expr2, context)).when(ExpressionUtils.isCall, (expr2) => this.evaluateCall(expr2, context)).when(ExpressionUtils.isThis, () => context.thisValue).when(ExpressionUtils.isNull, () => null).exhaustive();
+    return result ?? null;
+  }
+  evaluateCall(expr2, context) {
+    if (expr2.function === "auth") {
+      return context.auth;
+    } else {
+      throw new Error(`Unsupported call expression function: ${expr2.function}`);
+    }
+  }
+  evaluateUnary(expr2, context) {
+    return match(expr2.op).with("!", () => !this.evaluate(expr2.operand, context)).exhaustive();
+  }
+  evaluateMember(expr2, context) {
+    let val = this.evaluate(expr2.receiver, context);
+    for (const member of expr2.members) {
+      val = val?.[member];
+    }
+    return val;
+  }
+  evaluateLiteral(expr2) {
+    return expr2.value;
+  }
+  evaluateField(expr2, context) {
+    return context.thisValue?.[expr2.field];
+  }
+  evaluateArray(expr2, context) {
+    return expr2.items.map((item) => this.evaluate(item, context));
+  }
+  evaluateBinary(expr2, context) {
+    if (expr2.op === "?" || expr2.op === "!" || expr2.op === "^") {
+      return this.evaluateCollectionPredicate(expr2, context);
+    }
+    const left = this.evaluate(expr2.left, context);
+    const right = this.evaluate(expr2.right, context);
+    return match(expr2.op).with("==", () => left === right).with("!=", () => left !== right).with(">", () => left > right).with(">=", () => left >= right).with("<", () => left < right).with("<=", () => left <= right).with("&&", () => left && right).with("||", () => left || right).with("in", () => {
+      const _right = right ?? [];
+      invariant(Array.isArray(_right), 'expected array for "in" operator');
+      return _right.includes(left);
+    }).exhaustive();
+  }
+  evaluateCollectionPredicate(expr2, context) {
+    const op = expr2.op;
+    invariant(op === "?" || op === "!" || op === "^", 'expected "?" or "!" or "^" operator');
+    const left = this.evaluate(expr2.left, context);
+    if (!left) {
+      return false;
+    }
+    invariant(Array.isArray(left), "expected array");
+    return match(op).with("?", () => left.some((item) => this.evaluate(expr2.right, {
+      ...context,
+      thisValue: item
+    }))).with("!", () => left.every((item) => this.evaluate(expr2.right, {
+      ...context,
+      thisValue: item
+    }))).with("^", () => !left.some((item) => this.evaluate(expr2.right, {
+      ...context,
+      thisValue: item
+    }))).exhaustive();
+  }
+};
+
+// src/utils.ts
+import { ExpressionUtils as ExpressionUtils2 } from "@zenstackhq/runtime/schema";
+import { AliasNode, AndNode, BinaryOperationNode, FunctionNode, OperatorNode, OrNode, ParensNode, ReferenceNode, TableNode, UnaryOperationNode, ValueNode } from "kysely";
+function trueNode(dialect) {
+  return ValueNode.createImmediate(dialect.transformPrimitive(true, "Boolean", false));
+}
+__name(trueNode, "trueNode");
+function falseNode(dialect) {
+  return ValueNode.createImmediate(dialect.transformPrimitive(false, "Boolean", false));
+}
+__name(falseNode, "falseNode");
+function isTrueNode(node) {
+  return ValueNode.is(node) && (node.value === true || node.value === 1);
+}
+__name(isTrueNode, "isTrueNode");
+function isFalseNode(node) {
+  return ValueNode.is(node) && (node.value === false || node.value === 0);
+}
+__name(isFalseNode, "isFalseNode");
+function conjunction(dialect, nodes) {
+  if (nodes.length === 0) {
+    return trueNode(dialect);
+  }
+  if (nodes.length === 1) {
+    return nodes[0];
+  }
+  if (nodes.some(isFalseNode)) {
+    return falseNode(dialect);
+  }
+  const items = nodes.filter((n) => !isTrueNode(n));
+  if (items.length === 0) {
+    return trueNode(dialect);
+  }
+  return items.reduce((acc, node) => AndNode.create(wrapParensIf(acc, OrNode.is), wrapParensIf(node, OrNode.is)));
+}
+__name(conjunction, "conjunction");
+function disjunction(dialect, nodes) {
+  if (nodes.length === 0) {
+    return falseNode(dialect);
+  }
+  if (nodes.length === 1) {
+    return nodes[0];
+  }
+  if (nodes.some(isTrueNode)) {
+    return trueNode(dialect);
+  }
+  const items = nodes.filter((n) => !isFalseNode(n));
+  if (items.length === 0) {
+    return falseNode(dialect);
+  }
+  return items.reduce((acc, node) => OrNode.create(wrapParensIf(acc, AndNode.is), wrapParensIf(node, AndNode.is)));
+}
+__name(disjunction, "disjunction");
+function logicalNot(dialect, node) {
+  if (isTrueNode(node)) {
+    return falseNode(dialect);
+  }
+  if (isFalseNode(node)) {
+    return trueNode(dialect);
+  }
+  return UnaryOperationNode.create(OperatorNode.create("not"), wrapParensIf(node, (n) => AndNode.is(n) || OrNode.is(n)));
+}
+__name(logicalNot, "logicalNot");
+function wrapParensIf(node, predicate) {
+  return predicate(node) ? ParensNode.create(node) : node;
+}
+__name(wrapParensIf, "wrapParensIf");
+function buildIsFalse(node, dialect) {
+  if (isFalseNode(node)) {
+    return trueNode(dialect);
+  } else if (isTrueNode(node)) {
+    return falseNode(dialect);
+  }
+  return BinaryOperationNode.create(
+    // coalesce so null is treated as false
+    FunctionNode.create("coalesce", [
+      node,
+      falseNode(dialect)
+    ]),
+    OperatorNode.create("="),
+    falseNode(dialect)
+  );
+}
+__name(buildIsFalse, "buildIsFalse");
+function getTableName(node) {
+  if (!node) {
+    return node;
+  }
+  if (TableNode.is(node)) {
+    return node.table.identifier.name;
+  } else if (AliasNode.is(node)) {
+    return getTableName(node.node);
+  } else if (ReferenceNode.is(node) && node.table) {
+    return getTableName(node.table);
+  }
+  return void 0;
+}
+__name(getTableName, "getTableName");
+function isBeforeInvocation(expr2) {
+  return ExpressionUtils2.isCall(expr2) && expr2.function === "before";
+}
+__name(isBeforeInvocation, "isBeforeInvocation");
+
+// src/expression-transformer.ts
+function _ts_decorate(decorators, target, key, desc) {
+  var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+  if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+  else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+  return c > 3 && r && Object.defineProperty(target, key, r), r;
+}
+__name(_ts_decorate, "_ts_decorate");
+function _ts_metadata(k, v) {
+  if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+}
+__name(_ts_metadata, "_ts_metadata");
+var expressionHandlers = /* @__PURE__ */ new Map();
+function expr(kind) {
+  return function(_target, _propertyKey, descriptor) {
+    if (!expressionHandlers.get(kind)) {
+      expressionHandlers.set(kind, descriptor);
+    }
+    return descriptor;
+  };
+}
+__name(expr, "expr");
+var ExpressionTransformer = class {
+  static {
+    __name(this, "ExpressionTransformer");
+  }
+  client;
+  dialect;
+  constructor(client) {
+    this.client = client;
+    this.dialect = getCrudDialect(this.schema, this.clientOptions);
+  }
+  get schema() {
+    return this.client.$schema;
+  }
+  get clientOptions() {
+    return this.client.$options;
+  }
+  get auth() {
+    return this.client.$auth;
+  }
+  get authType() {
+    if (!this.schema.authType) {
+      throw new InternalError('Schema does not have an "authType" specified');
+    }
+    return this.schema.authType;
+  }
+  transform(expression, context) {
+    const handler = expressionHandlers.get(expression.kind);
+    if (!handler) {
+      throw new Error(`Unsupported expression kind: ${expression.kind}`);
+    }
+    return handler.value.call(this, expression, context);
+  }
+  _literal(expr2) {
+    return this.transformValue(expr2.value, typeof expr2.value === "string" ? "String" : typeof expr2.value === "boolean" ? "Boolean" : "Int");
+  }
+  _array(expr2, context) {
+    return ValueListNode.create(expr2.items.map((item) => this.transform(item, context)));
+  }
+  _field(expr2, context) {
+    const fieldDef = QueryUtils.requireField(this.schema, context.model, expr2.field);
+    if (!fieldDef.relation) {
+      return this.createColumnRef(expr2.field, context);
+    } else {
+      const { memberFilter, memberSelect, ...restContext } = context;
+      const relation = this.transformRelationAccess(expr2.field, fieldDef.type, restContext);
+      return {
+        ...relation,
+        where: this.mergeWhere(relation.where, memberFilter),
+        selections: memberSelect ? [
+          memberSelect
+        ] : relation.selections
+      };
+    }
+  }
+  mergeWhere(where, memberFilter) {
+    if (!where) {
+      return WhereNode.create(memberFilter ?? trueNode(this.dialect));
+    }
+    if (!memberFilter) {
+      return where;
+    }
+    return WhereNode.create(conjunction(this.dialect, [
+      where.where,
+      memberFilter
+    ]));
+  }
+  _null() {
+    return ValueNode2.createImmediate(null);
+  }
+  _binary(expr2, context) {
+    if (expr2.op === "&&") {
+      return conjunction(this.dialect, [
+        this.transform(expr2.left, context),
+        this.transform(expr2.right, context)
+      ]);
+    } else if (expr2.op === "||") {
+      return disjunction(this.dialect, [
+        this.transform(expr2.left, context),
+        this.transform(expr2.right, context)
+      ]);
+    }
+    if (this.isAuthCall(expr2.left) || this.isAuthCall(expr2.right)) {
+      return this.transformAuthBinary(expr2, context);
+    }
+    const op = expr2.op;
+    if (op === "?" || op === "!" || op === "^") {
+      return this.transformCollectionPredicate(expr2, context);
+    }
+    const { normalizedLeft, normalizedRight } = this.normalizeBinaryOperationOperands(expr2, context);
+    const left = this.transform(normalizedLeft, context);
+    const right = this.transform(normalizedRight, context);
+    if (op === "in") {
+      if (this.isNullNode(left)) {
+        return this.transformValue(false, "Boolean");
+      } else {
+        if (ValueListNode.is(right)) {
+          return BinaryOperationNode2.create(left, OperatorNode2.create("in"), right);
+        } else {
+          return BinaryOperationNode2.create(left, OperatorNode2.create("="), FunctionNode2.create("any", [
+            right
+          ]));
+        }
+      }
+    }
+    if (this.isNullNode(right)) {
+      return this.transformNullCheck(left, expr2.op);
+    } else if (this.isNullNode(left)) {
+      return this.transformNullCheck(right, expr2.op);
+    } else {
+      return BinaryOperationNode2.create(left, this.transformOperator(op), right);
+    }
+  }
+  transformNullCheck(expr2, operator) {
+    invariant2(operator === "==" || operator === "!=", 'operator must be "==" or "!=" for null comparison');
+    if (ValueNode2.is(expr2)) {
+      if (expr2.value === null) {
+        return operator === "==" ? trueNode(this.dialect) : falseNode(this.dialect);
+      } else {
+        return operator === "==" ? falseNode(this.dialect) : trueNode(this.dialect);
+      }
+    } else {
+      return operator === "==" ? BinaryOperationNode2.create(expr2, OperatorNode2.create("is"), ValueNode2.createImmediate(null)) : BinaryOperationNode2.create(expr2, OperatorNode2.create("is not"), ValueNode2.createImmediate(null));
+    }
+  }
+  normalizeBinaryOperationOperands(expr2, context) {
+    let normalizedLeft = expr2.left;
+    if (this.isRelationField(expr2.left, context.model)) {
+      invariant2(ExpressionUtils3.isNull(expr2.right), "only null comparison is supported for relation field");
+      const leftRelDef = this.getFieldDefFromFieldRef(expr2.left, context.model);
+      invariant2(leftRelDef, "failed to get relation field definition");
+      const idFields = QueryUtils.requireIdFields(this.schema, leftRelDef.type);
+      normalizedLeft = this.makeOrAppendMember(normalizedLeft, idFields[0]);
+    }
+    let normalizedRight = expr2.right;
+    if (this.isRelationField(expr2.right, context.model)) {
+      invariant2(ExpressionUtils3.isNull(expr2.left), "only null comparison is supported for relation field");
+      const rightRelDef = this.getFieldDefFromFieldRef(expr2.right, context.model);
+      invariant2(rightRelDef, "failed to get relation field definition");
+      const idFields = QueryUtils.requireIdFields(this.schema, rightRelDef.type);
+      normalizedRight = this.makeOrAppendMember(normalizedRight, idFields[0]);
+    }
+    return {
+      normalizedLeft,
+      normalizedRight
+    };
+  }
+  transformCollectionPredicate(expr2, context) {
+    invariant2(expr2.op === "?" || expr2.op === "!" || expr2.op === "^", 'expected "?" or "!" or "^" operator');
+    if (this.isAuthCall(expr2.left) || this.isAuthMember(expr2.left)) {
+      const value = new ExpressionEvaluator().evaluate(expr2, {
+        auth: this.auth
+      });
+      return this.transformValue(value, "Boolean");
+    }
+    invariant2(ExpressionUtils3.isField(expr2.left) || ExpressionUtils3.isMember(expr2.left), "left operand must be field or member access");
+    let newContextModel;
+    const fieldDef = this.getFieldDefFromFieldRef(expr2.left, context.model);
+    if (fieldDef) {
+      invariant2(fieldDef.relation, `field is not a relation: ${JSON.stringify(expr2.left)}`);
+      newContextModel = fieldDef.type;
+    } else {
+      invariant2(ExpressionUtils3.isMember(expr2.left) && ExpressionUtils3.isField(expr2.left.receiver), "left operand must be member access with field receiver");
+      const fieldDef2 = QueryUtils.requireField(this.schema, context.model, expr2.left.receiver.field);
+      newContextModel = fieldDef2.type;
+      for (const member of expr2.left.members) {
+        const memberDef = QueryUtils.requireField(this.schema, newContextModel, member);
+        newContextModel = memberDef.type;
+      }
+    }
+    let predicateFilter = this.transform(expr2.right, {
+      ...context,
+      model: newContextModel,
+      alias: void 0
+    });
+    if (expr2.op === "!") {
+      predicateFilter = logicalNot(this.dialect, predicateFilter);
+    }
+    const count = FunctionNode2.create("count", [
+      ValueNode2.createImmediate(1)
+    ]);
+    const predicateResult = match2(expr2.op).with("?", () => BinaryOperationNode2.create(count, OperatorNode2.create(">"), ValueNode2.createImmediate(0))).with("!", () => BinaryOperationNode2.create(count, OperatorNode2.create("="), ValueNode2.createImmediate(0))).with("^", () => BinaryOperationNode2.create(count, OperatorNode2.create("="), ValueNode2.createImmediate(0))).exhaustive();
+    return this.transform(expr2.left, {
+      ...context,
+      memberSelect: SelectionNode.create(AliasNode2.create(predicateResult, IdentifierNode.create("$t"))),
+      memberFilter: predicateFilter
+    });
+  }
+  transformAuthBinary(expr2, context) {
+    if (expr2.op !== "==" && expr2.op !== "!=") {
+      throw new QueryError(`Unsupported operator for \`auth()\` in policy of model "${context.model}": ${expr2.op}`);
+    }
+    let authExpr;
+    let other;
+    if (this.isAuthCall(expr2.left)) {
+      authExpr = expr2.left;
+      other = expr2.right;
+    } else {
+      authExpr = expr2.right;
+      other = expr2.left;
+    }
+    if (ExpressionUtils3.isNull(other)) {
+      return this.transformValue(expr2.op === "==" ? !this.auth : !!this.auth, "Boolean");
+    } else {
+      const authModel = QueryUtils.getModel(this.schema, this.authType);
+      if (!authModel) {
+        throw new QueryError(`Unsupported use of \`auth()\` in policy of model "${context.model}", comparing with \`auth()\` is only possible when auth type is a model`);
+      }
+      const idFields = Object.values(authModel.fields).filter((f) => f.id).map((f) => f.name);
+      invariant2(idFields.length > 0, "auth type model must have at least one id field");
+      const conditions = idFields.map((fieldName) => ExpressionUtils3.binary(ExpressionUtils3.member(authExpr, [
+        fieldName
+      ]), "==", this.makeOrAppendMember(other, fieldName)));
+      let result = this.buildAnd(conditions);
+      if (expr2.op === "!=") {
+        result = this.buildLogicalNot(result);
+      }
+      return this.transform(result, context);
+    }
+  }
+  makeOrAppendMember(other, fieldName) {
+    if (ExpressionUtils3.isMember(other)) {
+      return ExpressionUtils3.member(other.receiver, [
+        ...other.members,
+        fieldName
+      ]);
+    } else {
+      return ExpressionUtils3.member(other, [
+        fieldName
+      ]);
+    }
+  }
+  transformValue(value, type) {
+    if (value === true) {
+      return trueNode(this.dialect);
+    } else if (value === false) {
+      return falseNode(this.dialect);
+    } else {
+      return ValueNode2.create(this.dialect.transformPrimitive(value, type, false) ?? null);
+    }
+  }
+  _unary(expr2, context) {
+    invariant2(expr2.op === "!", 'only "!" operator is supported');
+    return logicalNot(this.dialect, this.transform(expr2.operand, context));
+  }
+  transformOperator(op) {
+    const mappedOp = match2(op).with("==", () => "=").otherwise(() => op);
+    return OperatorNode2.create(mappedOp);
+  }
+  _call(expr2, context) {
+    const result = this.transformCall(expr2, context);
+    return result.toOperationNode();
+  }
+  transformCall(expr2, context) {
+    const func = this.getFunctionImpl(expr2.function);
+    if (!func) {
+      throw new QueryError(`Function not implemented: ${expr2.function}`);
+    }
+    const eb = expressionBuilder();
+    return func(eb, (expr2.args ?? []).map((arg) => this.transformCallArg(eb, arg, context)), {
+      client: this.client,
+      dialect: this.dialect,
+      model: context.model,
+      modelAlias: context.alias ?? context.model,
+      operation: context.operation
+    });
+  }
+  getFunctionImpl(functionName) {
+    let func = this.clientOptions.functions?.[functionName];
+    if (!func) {
+      for (const plugin of this.clientOptions.plugins ?? []) {
+        if (plugin.functions?.[functionName]) {
+          func = plugin.functions[functionName];
+          break;
+        }
+      }
+    }
+    return func;
+  }
+  transformCallArg(eb, arg, context) {
+    if (ExpressionUtils3.isLiteral(arg)) {
+      return eb.val(arg.value);
+    }
+    if (ExpressionUtils3.isField(arg)) {
+      return eb.ref(arg.field);
+    }
+    if (ExpressionUtils3.isCall(arg)) {
+      return this.transformCall(arg, context);
+    }
+    if (this.isAuthMember(arg)) {
+      const valNode = this.valueMemberAccess(this.auth, arg, this.authType);
+      return valNode ? eb.val(valNode.value) : eb.val(null);
+    }
+    throw new InternalError(`Unsupported argument expression: ${arg.kind}`);
+  }
+  _member(expr2, context) {
+    if (this.isAuthCall(expr2.receiver)) {
+      return this.valueMemberAccess(this.auth, expr2, this.authType);
+    }
+    if (isBeforeInvocation(expr2.receiver)) {
+      invariant2(context.operation === "post-update", "before() can only be used in post-update policy");
+      invariant2(expr2.members.length === 1, "before() can only be followed by a scalar field access");
+      return ReferenceNode2.create(ColumnNode.create(expr2.members[0]), TableNode2.create("$before"));
+    }
+    invariant2(ExpressionUtils3.isField(expr2.receiver) || ExpressionUtils3.isThis(expr2.receiver), 'expect receiver to be field expression or "this"');
+    let members = expr2.members;
+    let receiver;
+    const { memberFilter, memberSelect, ...restContext } = context;
+    if (ExpressionUtils3.isThis(expr2.receiver)) {
+      if (expr2.members.length === 1) {
+        return this._field(ExpressionUtils3.field(expr2.members[0]), context);
+      } else {
+        const firstMemberFieldDef = QueryUtils.requireField(this.schema, context.model, expr2.members[0]);
+        receiver = this.transformRelationAccess(expr2.members[0], firstMemberFieldDef.type, restContext);
+        members = expr2.members.slice(1);
+      }
+    } else {
+      receiver = this.transform(expr2.receiver, restContext);
+    }
+    invariant2(SelectQueryNode.is(receiver), "expected receiver to be select query");
+    let startType;
+    if (ExpressionUtils3.isField(expr2.receiver)) {
+      const receiverField = QueryUtils.requireField(this.schema, context.model, expr2.receiver.field);
+      startType = receiverField.type;
+    } else {
+      startType = context.model;
+    }
+    const memberFields = [];
+    let currType = startType;
+    for (const member of members) {
+      const fieldDef = QueryUtils.requireField(this.schema, currType, member);
+      memberFields.push({
+        fieldDef,
+        fromModel: currType
+      });
+      currType = fieldDef.type;
+    }
+    let currNode = void 0;
+    for (let i = members.length - 1; i >= 0; i--) {
+      const member = members[i];
+      const { fieldDef, fromModel } = memberFields[i];
+      if (fieldDef.relation) {
+        const relation = this.transformRelationAccess(member, fieldDef.type, {
+          ...restContext,
+          model: fromModel,
+          alias: void 0
+        });
+        if (currNode) {
+          currNode = {
+            ...relation,
+            selections: [
+              SelectionNode.create(AliasNode2.create(currNode, IdentifierNode.create(members[i + 1])))
+            ]
+          };
+        } else {
+          currNode = {
+            ...relation,
+            where: this.mergeWhere(relation.where, memberFilter),
+            selections: memberSelect ? [
+              memberSelect
+            ] : relation.selections
+          };
+        }
+      } else {
+        invariant2(i === members.length - 1, "plain field access must be the last segment");
+        invariant2(!currNode, "plain field access must be the last segment");
+        currNode = ColumnNode.create(member);
+      }
+    }
+    return {
+      ...receiver,
+      selections: [
+        SelectionNode.create(AliasNode2.create(currNode, IdentifierNode.create("$t")))
+      ]
+    };
+  }
+  valueMemberAccess(receiver, expr2, receiverType) {
+    if (!receiver) {
+      return ValueNode2.createImmediate(null);
+    }
+    if (expr2.members.length !== 1) {
+      throw new Error(`Only single member access is supported`);
+    }
+    const field = expr2.members[0];
+    const fieldDef = QueryUtils.requireField(this.schema, receiverType, field);
+    const fieldValue = receiver[field] ?? null;
+    return this.transformValue(fieldValue, fieldDef.type);
+  }
+  transformRelationAccess(field, relationModel, context) {
+    const m2m = QueryUtils.getManyToManyRelation(this.schema, context.model, field);
+    if (m2m) {
+      return this.transformManyToManyRelationAccess(m2m, context);
+    }
+    const fromModel = context.model;
+    const relationFieldDef = QueryUtils.requireField(this.schema, fromModel, field);
+    const { keyPairs, ownedByModel } = QueryUtils.getRelationForeignKeyFieldPairs(this.schema, fromModel, field);
+    let condition;
+    if (ownedByModel) {
+      condition = conjunction(this.dialect, keyPairs.map(({ fk, pk }) => {
+        let fkRef = ReferenceNode2.create(ColumnNode.create(fk), TableNode2.create(context.alias ?? fromModel));
+        if (relationFieldDef.originModel && relationFieldDef.originModel !== fromModel) {
+          fkRef = this.buildDelegateBaseFieldSelect(fromModel, context.alias ?? fromModel, fk, relationFieldDef.originModel);
+        }
+        return BinaryOperationNode2.create(fkRef, OperatorNode2.create("="), ReferenceNode2.create(ColumnNode.create(pk), TableNode2.create(relationModel)));
+      }));
+    } else {
+      condition = conjunction(this.dialect, keyPairs.map(({ fk, pk }) => BinaryOperationNode2.create(ReferenceNode2.create(ColumnNode.create(pk), TableNode2.create(context.alias ?? fromModel)), OperatorNode2.create("="), ReferenceNode2.create(ColumnNode.create(fk), TableNode2.create(relationModel)))));
+    }
+    return {
+      kind: "SelectQueryNode",
+      from: FromNode.create([
+        TableNode2.create(relationModel)
+      ]),
+      where: WhereNode.create(condition)
+    };
+  }
+  transformManyToManyRelationAccess(m2m, context) {
+    const eb = expressionBuilder();
+    const relationQuery = eb.selectFrom(m2m.otherModel).innerJoin(m2m.joinTable, (join) => join.onRef(`${m2m.otherModel}.${m2m.otherPKName}`, "=", `${m2m.joinTable}.${m2m.otherFkName}`).onRef(`${m2m.joinTable}.${m2m.parentFkName}`, "=", `${context.alias ?? context.model}.${m2m.parentPKName}`));
+    return relationQuery.toOperationNode();
+  }
+  createColumnRef(column, context) {
+    const tableName = context.alias ?? context.model;
+    if (context.operation === "create") {
+      return ReferenceNode2.create(ColumnNode.create(column), TableNode2.create(tableName));
+    }
+    const fieldDef = QueryUtils.requireField(this.schema, context.model, column);
+    if (!fieldDef.originModel || fieldDef.originModel === context.model) {
+      return ReferenceNode2.create(ColumnNode.create(column), TableNode2.create(tableName));
+    }
+    return this.buildDelegateBaseFieldSelect(context.model, tableName, column, fieldDef.originModel);
+  }
+  buildDelegateBaseFieldSelect(model, modelAlias, field, baseModel) {
+    const idFields = QueryUtils.requireIdFields(this.client.$schema, model);
+    return {
+      kind: "SelectQueryNode",
+      from: FromNode.create([
+        TableNode2.create(baseModel)
+      ]),
+      selections: [
+        SelectionNode.create(ReferenceNode2.create(ColumnNode.create(field), TableNode2.create(baseModel)))
+      ],
+      where: WhereNode.create(conjunction(this.dialect, idFields.map((idField) => BinaryOperationNode2.create(ReferenceNode2.create(ColumnNode.create(idField), TableNode2.create(baseModel)), OperatorNode2.create("="), ReferenceNode2.create(ColumnNode.create(idField), TableNode2.create(modelAlias))))))
+    };
+  }
+  isAuthCall(value) {
+    return ExpressionUtils3.isCall(value) && value.function === "auth";
+  }
+  isAuthMember(expr2) {
+    return ExpressionUtils3.isMember(expr2) && this.isAuthCall(expr2.receiver);
+  }
+  isNullNode(node) {
+    return ValueNode2.is(node) && node.value === null;
+  }
+  buildLogicalNot(result) {
+    return ExpressionUtils3.unary("!", result);
+  }
+  buildAnd(conditions) {
+    if (conditions.length === 0) {
+      return ExpressionUtils3.literal(true);
+    } else if (conditions.length === 1) {
+      return conditions[0];
+    } else {
+      return conditions.reduce((acc, condition) => ExpressionUtils3.binary(acc, "&&", condition));
+    }
+  }
+  isRelationField(expr2, model) {
+    const fieldDef = this.getFieldDefFromFieldRef(expr2, model);
+    return !!fieldDef?.relation;
+  }
+  getFieldDefFromFieldRef(expr2, model) {
+    if (ExpressionUtils3.isField(expr2)) {
+      return QueryUtils.requireField(this.schema, model, expr2.field);
+    } else if (ExpressionUtils3.isMember(expr2) && expr2.members.length === 1 && ExpressionUtils3.isThis(expr2.receiver)) {
+      return QueryUtils.requireField(this.schema, model, expr2.members[0]);
+    } else {
+      return void 0;
+    }
+  }
+};
+_ts_decorate([
+  expr("literal"),
+  _ts_metadata("design:type", Function),
+  _ts_metadata("design:paramtypes", [
+    typeof LiteralExpression === "undefined" ? Object : LiteralExpression
+  ]),
+  _ts_metadata("design:returntype", void 0)
+], ExpressionTransformer.prototype, "_literal", null);
+_ts_decorate([
+  expr("array"),
+  _ts_metadata("design:type", Function),
+  _ts_metadata("design:paramtypes", [
+    typeof ArrayExpression === "undefined" ? Object : ArrayExpression,
+    typeof ExpressionTransformerContext === "undefined" ? Object : ExpressionTransformerContext
+  ]),
+  _ts_metadata("design:returntype", void 0)
+], ExpressionTransformer.prototype, "_array", null);
+_ts_decorate([
+  expr("field"),
+  _ts_metadata("design:type", Function),
+  _ts_metadata("design:paramtypes", [
+    typeof FieldExpression === "undefined" ? Object : FieldExpression,
+    typeof ExpressionTransformerContext === "undefined" ? Object : ExpressionTransformerContext
+  ]),
+  _ts_metadata("design:returntype", void 0)
+], ExpressionTransformer.prototype, "_field", null);
+_ts_decorate([
+  expr("null"),
+  _ts_metadata("design:type", Function),
+  _ts_metadata("design:paramtypes", []),
+  _ts_metadata("design:returntype", void 0)
+], ExpressionTransformer.prototype, "_null", null);
+_ts_decorate([
+  expr("binary"),
+  _ts_metadata("design:type", Function),
+  _ts_metadata("design:paramtypes", [
+    typeof BinaryExpression === "undefined" ? Object : BinaryExpression,
+    typeof ExpressionTransformerContext === "undefined" ? Object : ExpressionTransformerContext
+  ]),
+  _ts_metadata("design:returntype", void 0)
+], ExpressionTransformer.prototype, "_binary", null);
+_ts_decorate([
+  expr("unary"),
+  _ts_metadata("design:type", Function),
+  _ts_metadata("design:paramtypes", [
+    typeof UnaryExpression === "undefined" ? Object : UnaryExpression,
+    typeof ExpressionTransformerContext === "undefined" ? Object : ExpressionTransformerContext
+  ]),
+  _ts_metadata("design:returntype", void 0)
+], ExpressionTransformer.prototype, "_unary", null);
+_ts_decorate([
+  expr("call"),
+  _ts_metadata("design:type", Function),
+  _ts_metadata("design:paramtypes", [
+    typeof CallExpression === "undefined" ? Object : CallExpression,
+    typeof ExpressionTransformerContext === "undefined" ? Object : ExpressionTransformerContext
+  ]),
+  _ts_metadata("design:returntype", void 0)
+], ExpressionTransformer.prototype, "_call", null);
+_ts_decorate([
+  expr("member"),
+  _ts_metadata("design:type", Function),
+  _ts_metadata("design:paramtypes", [
+    typeof MemberExpression === "undefined" ? Object : MemberExpression,
+    typeof ExpressionTransformerContext === "undefined" ? Object : ExpressionTransformerContext
+  ]),
+  _ts_metadata("design:returntype", void 0)
+], ExpressionTransformer.prototype, "_member", null);
+
+// src/policy-handler.ts
+var PolicyHandler = class extends OperationNodeTransformer {
+  static {
+    __name(this, "PolicyHandler");
+  }
+  client;
+  dialect;
+  constructor(client) {
+    super(), this.client = client;
+    this.dialect = getCrudDialect2(this.client.$schema, this.client.$options);
+  }
+  get kysely() {
+    return this.client.$qb;
+  }
+  async handle(node, proceed) {
+    if (!this.isCrudQueryNode(node)) {
+      throw new RejectedByPolicyError(void 0, RejectedByPolicyReason.OTHER, "non-CRUD queries are not allowed");
+    }
+    if (!this.isMutationQueryNode(node)) {
+      return proceed(this.transformNode(node));
+    }
+    const { mutationModel } = this.getMutationModel(node);
+    if (InsertQueryNode.is(node)) {
+      const isManyToManyJoinTable = this.isManyToManyJoinTable(mutationModel);
+      let needCheckPreCreate = true;
+      if (!isManyToManyJoinTable) {
+        const constCondition = this.tryGetConstantPolicy(mutationModel, "create");
+        if (constCondition === true) {
+          needCheckPreCreate = false;
+        } else if (constCondition === false) {
+          throw new RejectedByPolicyError(mutationModel);
+        }
+      }
+      if (needCheckPreCreate) {
+        await this.enforcePreCreatePolicy(node, mutationModel, isManyToManyJoinTable, proceed);
+      }
+    }
+    const hasPostUpdatePolicies = UpdateQueryNode.is(node) && this.hasPostUpdatePolicies(mutationModel);
+    let beforeUpdateInfo;
+    if (hasPostUpdatePolicies) {
+      beforeUpdateInfo = await this.loadBeforeUpdateEntities(mutationModel, node.where, proceed);
+    }
+    const result = await proceed(this.transformNode(node));
+    if (hasPostUpdatePolicies && result.rows.length > 0) {
+      if (beforeUpdateInfo) {
+        invariant3(beforeUpdateInfo.rows.length === result.rows.length);
+        const idFields = QueryUtils2.requireIdFields(this.client.$schema, mutationModel);
+        for (const postRow of result.rows) {
+          const beforeRow = beforeUpdateInfo.rows.find((r) => idFields.every((f) => r[f] === postRow[f]));
+          if (!beforeRow) {
+            throw new QueryError2("Before-update and after-update rows do not match by id. If you have post-update policies on a model, updating id fields is not supported.");
+          }
+        }
+      }
+      const idConditions = this.buildIdConditions(mutationModel, result.rows);
+      const postUpdateFilter = this.buildPolicyFilter(mutationModel, void 0, "post-update");
+      const eb = expressionBuilder2();
+      const beforeUpdateTable = beforeUpdateInfo ? {
+        kind: "SelectQueryNode",
+        from: FromNode2.create([
+          ParensNode2.create(ValuesNode.create(beforeUpdateInfo.rows.map((r) => PrimitiveValueListNode.create(beforeUpdateInfo.fields.map((f) => r[f])))))
+        ]),
+        selections: beforeUpdateInfo.fields.map((name, index) => {
+          const def = QueryUtils2.requireField(this.client.$schema, mutationModel, name);
+          const castedColumnRef = sql`CAST(${eb.ref(`column${index + 1}`)} as ${sql.raw(this.dialect.getFieldSqlType(def))})`.as(name);
+          return SelectionNode2.create(castedColumnRef.toOperationNode());
+        })
+      } : void 0;
+      const postUpdateQuery = eb.selectFrom(mutationModel).select(() => [
+        eb(eb.fn("COUNT", [
+          eb.lit(1)
+        ]), "=", result.rows.length).as("$condition")
+      ]).where(() => new ExpressionWrapper(conjunction(this.dialect, [
+        idConditions,
+        postUpdateFilter
+      ]))).$if(!!beforeUpdateInfo, (qb) => qb.leftJoin(() => new ExpressionWrapper(beforeUpdateTable).as("$before"), (join) => {
+        const idFields = QueryUtils2.requireIdFields(this.client.$schema, mutationModel);
+        return idFields.reduce((acc, f) => acc.onRef(`${mutationModel}.${f}`, "=", `$before.${f}`), join);
+      }));
+      const postUpdateResult = await proceed(postUpdateQuery.toOperationNode());
+      if (!postUpdateResult.rows[0]?.$condition) {
+        throw new RejectedByPolicyError(mutationModel, RejectedByPolicyReason.NO_ACCESS, "some or all updated rows failed to pass post-update policy check");
+      }
+    }
+    if (!node.returning || this.onlyReturningId(node)) {
+      return this.postProcessMutationResult(result, node);
+    } else {
+      const readBackResult = await this.processReadBack(node, result, proceed);
+      if (readBackResult.rows.length !== result.rows.length) {
+        throw new RejectedByPolicyError(mutationModel, RejectedByPolicyReason.CANNOT_READ_BACK, "result is not allowed to be read back");
+      }
+      return readBackResult;
+    }
+  }
+  // correction to kysely mutation result may be needed because we might have added
+  // returning clause to the query and caused changes to the result shape
+  postProcessMutationResult(result, node) {
+    if (node.returning) {
+      return result;
+    } else {
+      return {
+        ...result,
+        rows: [],
+        numAffectedRows: result.numAffectedRows ?? BigInt(result.rows.length)
+      };
+    }
+  }
+  hasPostUpdatePolicies(model) {
+    const policies = this.getModelPolicies(model, "post-update");
+    return policies.length > 0;
+  }
+  async loadBeforeUpdateEntities(model, where, proceed) {
+    const beforeUpdateAccessFields = this.getFieldsAccessForBeforeUpdatePolicies(model);
+    if (!beforeUpdateAccessFields || beforeUpdateAccessFields.length === 0) {
+      return void 0;
+    }
+    const policyFilter = this.buildPolicyFilter(model, model, "update");
+    const combinedFilter = where ? conjunction(this.dialect, [
+      where.where,
+      policyFilter
+    ]) : policyFilter;
+    const query = {
+      kind: "SelectQueryNode",
+      from: FromNode2.create([
+        TableNode3.create(model)
+      ]),
+      where: WhereNode2.create(combinedFilter),
+      selections: [
+        ...beforeUpdateAccessFields.map((f) => SelectionNode2.create(ColumnNode2.create(f)))
+      ]
+    };
+    const result = await proceed(query);
+    return {
+      fields: beforeUpdateAccessFields,
+      rows: result.rows
+    };
+  }
+  getFieldsAccessForBeforeUpdatePolicies(model) {
+    const policies = this.getModelPolicies(model, "post-update");
+    if (policies.length === 0) {
+      return void 0;
+    }
+    const fields = /* @__PURE__ */ new Set();
+    const fieldCollector = new class extends ExpressionVisitor {
+      visitMember(e) {
+        if (isBeforeInvocation(e.receiver)) {
+          invariant3(e.members.length === 1, "before() can only be followed by a scalar field access");
+          fields.add(e.members[0]);
+        }
+        super.visitMember(e);
+      }
+    }();
+    for (const policy of policies) {
+      fieldCollector.visit(policy.condition);
+    }
+    if (fields.size === 0) {
+      return void 0;
+    }
+    QueryUtils2.requireIdFields(this.client.$schema, model).forEach((f) => fields.add(f));
+    return Array.from(fields).sort();
+  }
+  // #region overrides
+  transformSelectQuery(node) {
+    if (!node.from) {
+      return super.transformSelectQuery(node);
+    }
+    let whereNode = this.transformNode(node.where);
+    const policyFilter = this.createPolicyFilterForFrom(node.from);
+    if (policyFilter) {
+      whereNode = WhereNode2.create(whereNode?.where ? conjunction(this.dialect, [
+        whereNode.where,
+        policyFilter
+      ]) : policyFilter);
+    }
+    const baseResult = super.transformSelectQuery({
+      ...node,
+      where: void 0
+    });
+    return {
+      ...baseResult,
+      where: whereNode
+    };
+  }
+  transformJoin(node) {
+    const table = this.extractTableName(node.table);
+    if (!table) {
+      return super.transformJoin(node);
+    }
+    const filter = this.buildPolicyFilter(table.model, table.alias, "read");
+    const nestedSelect = {
+      kind: "SelectQueryNode",
+      from: FromNode2.create([
+        node.table
+      ]),
+      selections: [
+        SelectionNode2.createSelectAll()
+      ],
+      where: WhereNode2.create(filter)
+    };
+    return {
+      ...node,
+      table: AliasNode3.create(ParensNode2.create(nestedSelect), IdentifierNode2.create(table.alias ?? table.model))
+    };
+  }
+  transformInsertQuery(node) {
+    let onConflict = node.onConflict;
+    if (onConflict?.updates) {
+      const { mutationModel, alias } = this.getMutationModel(node);
+      const filter = this.buildPolicyFilter(mutationModel, alias, "update");
+      if (onConflict.updateWhere) {
+        onConflict = {
+          ...onConflict,
+          updateWhere: WhereNode2.create(conjunction(this.dialect, [
+            onConflict.updateWhere.where,
+            filter
+          ]))
+        };
+      } else {
+        onConflict = {
+          ...onConflict,
+          updateWhere: WhereNode2.create(filter)
+        };
+      }
+    }
+    const processedNode = onConflict ? {
+      ...node,
+      onConflict
+    } : node;
+    const result = super.transformInsertQuery(processedNode);
+    let returning = result.returning;
+    if (returning) {
+      const { mutationModel } = this.getMutationModel(node);
+      const idFields = QueryUtils2.requireIdFields(this.client.$schema, mutationModel);
+      returning = ReturningNode.create(idFields.map((f) => SelectionNode2.create(ColumnNode2.create(f))));
+    }
+    return {
+      ...result,
+      returning
+    };
+  }
+  transformUpdateQuery(node) {
+    const result = super.transformUpdateQuery(node);
+    const { mutationModel, alias } = this.getMutationModel(node);
+    let filter = this.buildPolicyFilter(mutationModel, alias, "update");
+    if (node.from) {
+      const joinFilter = this.createPolicyFilterForFrom(node.from);
+      if (joinFilter) {
+        filter = conjunction(this.dialect, [
+          filter,
+          joinFilter
+        ]);
+      }
+    }
+    let returning = result.returning;
+    if (returning || this.hasPostUpdatePolicies(mutationModel)) {
+      const idFields = QueryUtils2.requireIdFields(this.client.$schema, mutationModel);
+      returning = ReturningNode.create(idFields.map((f) => SelectionNode2.create(ColumnNode2.create(f))));
+    }
+    return {
+      ...result,
+      where: WhereNode2.create(result.where ? conjunction(this.dialect, [
+        result.where.where,
+        filter
+      ]) : filter),
+      returning
+    };
+  }
+  transformDeleteQuery(node) {
+    const result = super.transformDeleteQuery(node);
+    const { mutationModel, alias } = this.getMutationModel(node);
+    let filter = this.buildPolicyFilter(mutationModel, alias, "delete");
+    if (node.using) {
+      const joinFilter = this.createPolicyFilterForTables(node.using.tables);
+      if (joinFilter) {
+        filter = conjunction(this.dialect, [
+          filter,
+          joinFilter
+        ]);
+      }
+    }
+    return {
+      ...result,
+      where: WhereNode2.create(result.where ? conjunction(this.dialect, [
+        result.where.where,
+        filter
+      ]) : filter)
+    };
+  }
+  // #endregion
+  // #region helpers
+  onlyReturningId(node) {
+    if (!node.returning) {
+      return true;
+    }
+    const { mutationModel } = this.getMutationModel(node);
+    const idFields = QueryUtils2.requireIdFields(this.client.$schema, mutationModel);
+    if (node.returning.selections.some((s) => SelectAllNode.is(s.selection))) {
+      const modelDef = QueryUtils2.requireModel(this.client.$schema, mutationModel);
+      if (Object.keys(modelDef.fields).some((f) => !idFields.includes(f))) {
+        return false;
+      } else {
+        return true;
+      }
+    }
+    const collector = new ColumnCollector();
+    const selectedColumns = collector.collect(node.returning);
+    return selectedColumns.every((c) => idFields.includes(c));
+  }
+  async enforcePreCreatePolicy(node, mutationModel, isManyToManyJoinTable, proceed) {
+    const fields = node.columns?.map((c) => c.column.name) ?? [];
+    const valueRows = node.values ? this.unwrapCreateValueRows(node.values, mutationModel, fields, isManyToManyJoinTable) : [
+      []
+    ];
+    for (const values of valueRows) {
+      if (isManyToManyJoinTable) {
+        await this.enforcePreCreatePolicyForManyToManyJoinTable(mutationModel, fields, values.map((v) => v.node), proceed);
+      } else {
+        await this.enforcePreCreatePolicyForOne(mutationModel, fields, values.map((v) => v.node), proceed);
+      }
+    }
+  }
+  async enforcePreCreatePolicyForManyToManyJoinTable(tableName, fields, values, proceed) {
+    const m2m = this.resolveManyToManyJoinTable(tableName);
+    invariant3(m2m);
+    invariant3(fields.includes("A") && fields.includes("B"), "many-to-many join table must have A and B fk fields");
+    const aIndex = fields.indexOf("A");
+    const aNode = values[aIndex];
+    const bIndex = fields.indexOf("B");
+    const bNode = values[bIndex];
+    invariant3(ValueNode3.is(aNode) && ValueNode3.is(bNode), "A and B values must be ValueNode");
+    const aValue = aNode.value;
+    const bValue = bNode.value;
+    invariant3(aValue !== null && aValue !== void 0, "A value cannot be null or undefined");
+    invariant3(bValue !== null && bValue !== void 0, "B value cannot be null or undefined");
+    const eb = expressionBuilder2();
+    const filterA = this.buildPolicyFilter(m2m.firstModel, void 0, "update");
+    const queryA = eb.selectFrom(m2m.firstModel).where(eb(eb.ref(`${m2m.firstModel}.${m2m.firstIdField}`), "=", aValue)).select(() => new ExpressionWrapper(filterA).as("$t"));
+    const filterB = this.buildPolicyFilter(m2m.secondModel, void 0, "update");
+    const queryB = eb.selectFrom(m2m.secondModel).where(eb(eb.ref(`${m2m.secondModel}.${m2m.secondIdField}`), "=", bValue)).select(() => new ExpressionWrapper(filterB).as("$t"));
+    const queryNode = {
+      kind: "SelectQueryNode",
+      selections: [
+        SelectionNode2.create(AliasNode3.create(queryA.toOperationNode(), IdentifierNode2.create("$conditionA"))),
+        SelectionNode2.create(AliasNode3.create(queryB.toOperationNode(), IdentifierNode2.create("$conditionB")))
+      ]
+    };
+    const result = await proceed(queryNode);
+    if (!result.rows[0]?.$conditionA) {
+      throw new RejectedByPolicyError(m2m.firstModel, RejectedByPolicyReason.CANNOT_READ_BACK, `many-to-many relation participant model "${m2m.firstModel}" not updatable`);
+    }
+    if (!result.rows[0]?.$conditionB) {
+      throw new RejectedByPolicyError(m2m.secondModel, RejectedByPolicyReason.NO_ACCESS, `many-to-many relation participant model "${m2m.secondModel}" not updatable`);
+    }
+  }
+  async enforcePreCreatePolicyForOne(model, fields, values, proceed) {
+    const allFields = Object.entries(QueryUtils2.requireModel(this.client.$schema, model).fields).filter(([, def]) => !def.relation);
+    const allValues = [];
+    for (const [name, _def] of allFields) {
+      const index = fields.indexOf(name);
+      if (index >= 0) {
+        allValues.push(values[index]);
+      } else {
+        allValues.push(ValueNode3.createImmediate(null));
+      }
+    }
+    const eb = expressionBuilder2();
+    const constTable = {
+      kind: "SelectQueryNode",
+      from: FromNode2.create([
+        AliasNode3.create(ParensNode2.create(ValuesNode.create([
+          ValueListNode2.create(allValues)
+        ])), IdentifierNode2.create("$t"))
+      ]),
+      selections: allFields.map(([name, def], index) => {
+        const castedColumnRef = sql`CAST(${eb.ref(`column${index + 1}`)} as ${sql.raw(this.dialect.getFieldSqlType(def))})`.as(name);
+        return SelectionNode2.create(castedColumnRef.toOperationNode());
+      })
+    };
+    const filter = this.buildPolicyFilter(model, void 0, "create");
+    const preCreateCheck = {
+      kind: "SelectQueryNode",
+      from: FromNode2.create([
+        AliasNode3.create(constTable, IdentifierNode2.create(model))
+      ]),
+      selections: [
+        SelectionNode2.create(AliasNode3.create(BinaryOperationNode3.create(FunctionNode3.create("COUNT", [
+          ValueNode3.createImmediate(1)
+        ]), OperatorNode3.create(">"), ValueNode3.createImmediate(0)), IdentifierNode2.create("$condition")))
+      ],
+      where: WhereNode2.create(filter)
+    };
+    const result = await proceed(preCreateCheck);
+    if (!result.rows[0]?.$condition) {
+      throw new RejectedByPolicyError(model);
+    }
+  }
+  unwrapCreateValueRows(node, model, fields, isManyToManyJoinTable) {
+    if (ValuesNode.is(node)) {
+      return node.values.map((v) => this.unwrapCreateValueRow(v.values, model, fields, isManyToManyJoinTable));
+    } else if (PrimitiveValueListNode.is(node)) {
+      return [
+        this.unwrapCreateValueRow(node.values, model, fields, isManyToManyJoinTable)
+      ];
+    } else {
+      throw new InternalError2(`Unexpected node kind: ${node.kind} for unwrapping create values`);
+    }
+  }
+  unwrapCreateValueRow(data, model, fields, isImplicitManyToManyJoinTable) {
+    invariant3(data.length === fields.length, "data length must match fields length");
+    const result = [];
+    for (let i = 0; i < data.length; i++) {
+      const item = data[i];
+      if (typeof item === "object" && item && "kind" in item) {
+        const fieldDef = QueryUtils2.requireField(this.client.$schema, model, fields[i]);
+        invariant3(item.kind === "ValueNode", "expecting a ValueNode");
+        result.push({
+          node: ValueNode3.create(this.dialect.transformPrimitive(item.value, fieldDef.type, !!fieldDef.array)),
+          raw: item.value
+        });
+      } else {
+        let value = item;
+        if (!isImplicitManyToManyJoinTable) {
+          const fieldDef = QueryUtils2.requireField(this.client.$schema, model, fields[i]);
+          value = this.dialect.transformPrimitive(item, fieldDef.type, !!fieldDef.array);
+        }
+        if (Array.isArray(value)) {
+          result.push({
+            node: RawNode.createWithSql(this.dialect.buildArrayLiteralSQL(value)),
+            raw: value
+          });
+        } else {
+          result.push({
+            node: ValueNode3.create(value),
+            raw: value
+          });
+        }
+      }
+    }
+    return result;
+  }
+  tryGetConstantPolicy(model, operation) {
+    const policies = this.getModelPolicies(model, operation);
+    if (!policies.some((p) => p.kind === "allow")) {
+      return false;
+    } else if (
+      // unconditional deny
+      policies.some((p) => p.kind === "deny" && this.isTrueExpr(p.condition))
+    ) {
+      return false;
+    } else if (
+      // unconditional allow
+      !policies.some((p) => p.kind === "deny") && policies.some((p) => p.kind === "allow" && this.isTrueExpr(p.condition))
+    ) {
+      return true;
+    } else {
+      return void 0;
+    }
+  }
+  isTrueExpr(expr2) {
+    return ExpressionUtils4.isLiteral(expr2) && expr2.value === true;
+  }
+  async processReadBack(node, result, proceed) {
+    if (result.rows.length === 0) {
+      return result;
+    }
+    if (!this.isMutationQueryNode(node) || !node.returning) {
+      return result;
+    }
+    const { mutationModel } = this.getMutationModel(node);
+    const idConditions = this.buildIdConditions(mutationModel, result.rows);
+    const policyFilter = this.buildPolicyFilter(mutationModel, void 0, "read");
+    const select = {
+      kind: "SelectQueryNode",
+      from: FromNode2.create([
+        TableNode3.create(mutationModel)
+      ]),
+      where: WhereNode2.create(conjunction(this.dialect, [
+        idConditions,
+        policyFilter
+      ])),
+      selections: node.returning.selections
+    };
+    const selectResult = await proceed(select);
+    return selectResult;
+  }
+  buildIdConditions(table, rows) {
+    const idFields = QueryUtils2.requireIdFields(this.client.$schema, table);
+    return disjunction(this.dialect, rows.map((row) => conjunction(this.dialect, idFields.map((field) => BinaryOperationNode3.create(ReferenceNode3.create(ColumnNode2.create(field), TableNode3.create(table)), OperatorNode3.create("="), ValueNode3.create(row[field]))))));
+  }
+  getMutationModel(node) {
+    const r = match3(node).when(InsertQueryNode.is, (node2) => ({
+      mutationModel: getTableName(node2.into),
+      alias: void 0
+    })).when(UpdateQueryNode.is, (node2) => {
+      if (!node2.table) {
+        throw new QueryError2("Update query must have a table");
+      }
+      const r2 = this.extractTableName(node2.table);
+      return r2 ? {
+        mutationModel: r2.model,
+        alias: r2.alias
+      } : void 0;
+    }).when(DeleteQueryNode.is, (node2) => {
+      if (node2.from.froms.length !== 1) {
+        throw new QueryError2("Only one from table is supported for delete");
+      }
+      const r2 = this.extractTableName(node2.from.froms[0]);
+      return r2 ? {
+        mutationModel: r2.model,
+        alias: r2.alias
+      } : void 0;
+    }).exhaustive();
+    if (!r) {
+      throw new InternalError2(`Unable to get table name for query node: ${node}`);
+    }
+    return r;
+  }
+  isCrudQueryNode(node) {
+    return SelectQueryNode2.is(node) || InsertQueryNode.is(node) || UpdateQueryNode.is(node) || DeleteQueryNode.is(node);
+  }
+  isMutationQueryNode(node) {
+    return InsertQueryNode.is(node) || UpdateQueryNode.is(node) || DeleteQueryNode.is(node);
+  }
+  buildPolicyFilter(model, alias, operation) {
+    const m2mFilter = this.getModelPolicyFilterForManyToManyJoinTable(model, alias, operation);
+    if (m2mFilter) {
+      return m2mFilter;
+    }
+    const policies = this.getModelPolicies(model, operation);
+    const allows = policies.filter((policy) => policy.kind === "allow").map((policy) => this.compilePolicyCondition(model, alias, operation, policy));
+    const denies = policies.filter((policy) => policy.kind === "deny").map((policy) => this.compilePolicyCondition(model, alias, operation, policy));
+    let combinedPolicy;
+    if (allows.length === 0) {
+      if (operation === "post-update") {
+        combinedPolicy = trueNode(this.dialect);
+      } else {
+        combinedPolicy = falseNode(this.dialect);
+      }
+    } else {
+      combinedPolicy = disjunction(this.dialect, allows);
+    }
+    if (denies.length !== 0) {
+      const combinedDenies = conjunction(this.dialect, denies.map((d) => buildIsFalse(d, this.dialect)));
+      combinedPolicy = conjunction(this.dialect, [
+        combinedPolicy,
+        combinedDenies
+      ]);
+    }
+    return combinedPolicy;
+  }
+  extractTableName(node) {
+    if (TableNode3.is(node)) {
+      return {
+        model: node.table.identifier.name
+      };
+    }
+    if (AliasNode3.is(node)) {
+      const inner = this.extractTableName(node.node);
+      if (!inner) {
+        return void 0;
+      }
+      return {
+        model: inner.model,
+        alias: IdentifierNode2.is(node.alias) ? node.alias.name : void 0
+      };
+    } else {
+      return void 0;
+    }
+  }
+  createPolicyFilterForFrom(node) {
+    if (!node) {
+      return void 0;
+    }
+    return this.createPolicyFilterForTables(node.froms);
+  }
+  createPolicyFilterForTables(tables) {
+    return tables.reduce((acc, table) => {
+      const extractResult = this.extractTableName(table);
+      if (extractResult) {
+        const { model, alias } = extractResult;
+        const filter = this.buildPolicyFilter(model, alias, "read");
+        return acc ? conjunction(this.dialect, [
+          acc,
+          filter
+        ]) : filter;
+      }
+      return acc;
+    }, void 0);
+  }
+  compilePolicyCondition(model, alias, operation, policy) {
+    return new ExpressionTransformer(this.client).transform(policy.condition, {
+      model,
+      alias,
+      operation
+    });
+  }
+  getModelPolicies(model, operation) {
+    const modelDef = QueryUtils2.requireModel(this.client.$schema, model);
+    const result = [];
+    const extractOperations = /* @__PURE__ */ __name((expr2) => {
+      invariant3(ExpressionUtils4.isLiteral(expr2), "expecting a literal");
+      invariant3(typeof expr2.value === "string", "expecting a string literal");
+      return expr2.value.split(",").filter((v) => !!v).map((v) => v.trim());
+    }, "extractOperations");
+    if (modelDef.attributes) {
+      result.push(...modelDef.attributes.filter((attr) => attr.name === "@@allow" || attr.name === "@@deny").map((attr) => ({
+        kind: attr.name === "@@allow" ? "allow" : "deny",
+        operations: extractOperations(attr.args[0].value),
+        condition: attr.args[1].value
+      })).filter((policy) => operation !== "post-update" && policy.operations.includes("all") || policy.operations.includes(operation)));
+    }
+    return result;
+  }
+  resolveManyToManyJoinTable(tableName) {
+    for (const model of Object.values(this.client.$schema.models)) {
+      for (const field of Object.values(model.fields)) {
+        const m2m = QueryUtils2.getManyToManyRelation(this.client.$schema, model.name, field.name);
+        if (m2m?.joinTable === tableName) {
+          const sortedRecord = [
+            {
+              model: model.name,
+              field: field.name
+            },
+            {
+              model: m2m.otherModel,
+              field: m2m.otherField
+            }
+          ].sort(this.manyToManySorter);
+          const firstIdFields = QueryUtils2.requireIdFields(this.client.$schema, sortedRecord[0].model);
+          const secondIdFields = QueryUtils2.requireIdFields(this.client.$schema, sortedRecord[1].model);
+          invariant3(firstIdFields.length === 1 && secondIdFields.length === 1, "only single-field id is supported for implicit many-to-many join table");
+          return {
+            firstModel: sortedRecord[0].model,
+            firstField: sortedRecord[0].field,
+            firstIdField: firstIdFields[0],
+            secondModel: sortedRecord[1].model,
+            secondField: sortedRecord[1].field,
+            secondIdField: secondIdFields[0]
+          };
+        }
+      }
+    }
+    return void 0;
+  }
+  manyToManySorter(a, b) {
+    return a.model !== b.model ? a.model.localeCompare(b.model) : a.field.localeCompare(b.field);
+  }
+  isManyToManyJoinTable(tableName) {
+    return !!this.resolveManyToManyJoinTable(tableName);
+  }
+  getModelPolicyFilterForManyToManyJoinTable(tableName, alias, operation) {
+    const m2m = this.resolveManyToManyJoinTable(tableName);
+    if (!m2m) {
+      return void 0;
+    }
+    const checkForOperation = operation === "read" ? "read" : "update";
+    const eb = expressionBuilder2();
+    const joinTable = alias ?? tableName;
+    const aQuery = eb.selectFrom(m2m.firstModel).whereRef(`${m2m.firstModel}.${m2m.firstIdField}`, "=", `${joinTable}.A`).select(() => new ExpressionWrapper(this.buildPolicyFilter(m2m.firstModel, void 0, checkForOperation)).as("$conditionA"));
+    const bQuery = eb.selectFrom(m2m.secondModel).whereRef(`${m2m.secondModel}.${m2m.secondIdField}`, "=", `${joinTable}.B`).select(() => new ExpressionWrapper(this.buildPolicyFilter(m2m.secondModel, void 0, checkForOperation)).as("$conditionB"));
+    return eb.and([
+      aQuery,
+      bQuery
+    ]).toOperationNode();
+  }
+};
+
+// src/functions.ts
+var check = /* @__PURE__ */ __name((eb, args, { client, model, modelAlias, operation }) => {
+  invariant4(args.length === 1 || args.length === 2, '"check" function requires 1 or 2 arguments');
+  const arg1Node = args[0].toOperationNode();
+  const arg2Node = args.length === 2 ? args[1].toOperationNode() : void 0;
+  if (arg2Node) {
+    invariant4(ValueNode4.is(arg2Node) && typeof arg2Node.value === "string", '"operation" parameter must be a string literal when provided');
+    invariant4(CRUD.includes(arg2Node.value), '"operation" parameter must be one of "create", "read", "update", "delete"');
+  }
+  const fieldName = QueryUtils3.extractFieldName(arg1Node);
+  invariant4(fieldName, 'Failed to extract field name from the first argument of "check" function');
+  const fieldDef = QueryUtils3.requireField(client.$schema, model, fieldName);
+  invariant4(fieldDef.relation, `Field "${fieldName}" is not a relation field in model "${model}"`);
+  invariant4(!fieldDef.array, `Field "${fieldName}" is a to-many relation, which is not supported by "check"`);
+  const relationModel = fieldDef.type;
+  const joinConditions = [];
+  const fkInfo = QueryUtils3.getRelationForeignKeyFieldPairs(client.$schema, model, fieldName);
+  const idFields = QueryUtils3.requireIdFields(client.$schema, model);
+  const buildBaseSelect = /* @__PURE__ */ __name((baseModel, field) => {
+    return eb.selectFrom(baseModel).select(field).where(eb.and(idFields.map((idField) => eb(eb.ref(`${fieldDef.originModel}.${idField}`), "=", eb.ref(`${modelAlias}.${idField}`)))));
+  }, "buildBaseSelect");
+  if (fkInfo.ownedByModel) {
+    joinConditions.push(...fkInfo.keyPairs.map(({ fk, pk }) => {
+      let fkRef;
+      if (fieldDef.originModel && fieldDef.originModel !== model) {
+        fkRef = buildBaseSelect(fieldDef.originModel, fk);
+      } else {
+        fkRef = eb.ref(`${modelAlias}.${fk}`);
+      }
+      return eb(fkRef, "=", eb.ref(`${relationModel}.${pk}`));
+    }));
+  } else {
+    joinConditions.push(...fkInfo.keyPairs.map(({ fk, pk }) => {
+      let pkRef;
+      if (fieldDef.originModel && fieldDef.originModel !== model) {
+        pkRef = buildBaseSelect(fieldDef.originModel, pk);
+      } else {
+        pkRef = eb.ref(`${modelAlias}.${pk}`);
+      }
+      return eb(pkRef, "=", eb.ref(`${relationModel}.${fk}`));
+    }));
+  }
+  const joinCondition = joinConditions.length === 1 ? joinConditions[0] : eb.and(joinConditions);
+  const policyHandler = new PolicyHandler(client);
+  const op = arg2Node ? arg2Node.value : operation;
+  const policyCondition = policyHandler.buildPolicyFilter(relationModel, void 0, op);
+  const result = eb.selectFrom(relationModel).where(joinCondition).select(new ExpressionWrapper2(policyCondition).as("$condition"));
+  return result;
+}, "check");
+
+// src/plugin.ts
+var PolicyPlugin = class {
+  static {
+    __name(this, "PolicyPlugin");
+  }
+  get id() {
+    return "policy";
+  }
+  get name() {
+    return "Access Policy";
+  }
+  get description() {
+    return "Enforces access policies defined in the schema.";
+  }
+  get functions() {
+    return {
+      check
+    };
+  }
+  onKyselyQuery({ query, client, proceed }) {
+    const handler = new PolicyHandler(client);
+    return handler.handle(query, proceed);
+  }
+};
+export {
+  PolicyPlugin
+};
+//# sourceMappingURL=index.js.map