@zenstackhq/runtime 1.0.0-alpha.99 → 1.0.0-beta.10

package/enhancements/policy/policy-utils.js

@@ -14,27 +14,30 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.PolicyUtil = void 0;
-const runtime_1 = require("@prisma/client/runtime");
-const sdk_1 = require("@zenstackhq/sdk");
-const change_case_1 = require("change-case");
-const cuid_1 = __importDefault(require("cuid"));
+const cuid2_1 = require("@paralleldrive/cuid2");
 const deepcopy_1 = __importDefault(require("deepcopy"));
+const lower_case_first_1 = require("lower-case-first");
+const pluralize_1 = __importDefault(require("pluralize"));
+const upper_case_first_1 = require("upper-case-first");
 const zod_validation_error_1 = require("zod-validation-error");
+const constants_1 = require("../../constants");
+const error_1 = require("../../error");
 const version_1 = require("../../version");
 const model_meta_1 = require("../model-meta");
 const nested_write_vistor_1 = require("../nested-write-vistor");
 const utils_1 = require("../utils");
 const logger_1 = require("./logger");
-const pluralize_1 = __importDefault(require("pluralize"));
 /**
  * Access policy enforcement utilities
  */
 class PolicyUtil {
-    constructor(db, modelMeta, policy, user) {
+    constructor(db, modelMeta, policy, zodSchemas, user, logPrismaQuery) {
         this.db = db;
         this.modelMeta = modelMeta;
         this.policy = policy;
+        this.zodSchemas = zodSchemas;
         this.user = user;
+        this.logPrismaQuery = logPrismaQuery;
         this.logger = new logger_1.Logger(db);
     }
     /**
@@ -43,7 +46,7 @@ class PolicyUtil {
     and(...conditions) {
         if (conditions.includes(false)) {
             // always false
-            return { [sdk_1.GUARD_FIELD_NAME]: false };
+            return { [constants_1.GUARD_FIELD_NAME]: false };
         }
         const filtered = conditions.filter((c) => typeof c === 'object' && !!c && Object.keys(c).length > 0);
         if (filtered.length === 0) {
@@ -62,7 +65,7 @@ class PolicyUtil {
     or(...conditions) {
         if (conditions.includes(true)) {
             // always true
-            return { [sdk_1.GUARD_FIELD_NAME]: true };
+            return { [constants_1.GUARD_FIELD_NAME]: true };
         }
         const filtered = conditions.filter((c) => typeof c === 'object' && !!c);
         if (filtered.length === 0) {
@@ -93,24 +96,26 @@ class PolicyUtil {
      * otherwise returns a guard object
      */
     getAuthGuard(model, operation, preValue) {
-        return __awaiter(this, void 0, void 0, function* () {
-            const guard = this.policy.guard[(0, change_case_1.camelCase)(model)];
-            if (!guard) {
-                throw this.unknownError(`unable to load policy guard for ${model}`);
-            }
-            const provider = guard[operation];
-            if (typeof provider === 'boolean') {
-                return provider;
-            }
-            if (!provider) {
-                throw this.unknownError(`zenstack: unable to load authorization guard for ${model}`);
-            }
-            return provider({ user: this.user, preValue });
-        });
+        const guard = this.policy.guard[(0, lower_case_first_1.lowerCaseFirst)(model)];
+        if (!guard) {
+            throw this.unknownError(`unable to load policy guard for ${model}`);
+        }
+        const provider = guard[operation];
+        if (typeof provider === 'boolean') {
+            return provider;
+        }
+        if (!provider) {
+            throw this.unknownError(`zenstack: unable to load authorization guard for ${model}`);
+        }
+        return provider({ user: this.user, preValue });
+    }
+    hasValidation(model) {
+        var _a, _b;
+        return ((_b = (_a = this.policy.validation) === null || _a === void 0 ? void 0 : _a[(0, lower_case_first_1.lowerCaseFirst)(model)]) === null || _b === void 0 ? void 0 : _b.hasValidation) === true;
     }
     getPreValueSelect(model) {
         return __awaiter(this, void 0, void 0, function* () {
-            const guard = this.policy.guard[(0, change_case_1.camelCase)(model)];
+            const guard = this.policy.guard[(0, lower_case_first_1.lowerCaseFirst)(model)];
             if (!guard) {
                 throw this.unknownError(`unable to load policy guard for ${model}`);
             }
@@ -118,9 +123,8 @@ class PolicyUtil {
         });
     }
     getModelSchema(model) {
-        return __awaiter(this, void 0, void 0, function* () {
-            return this.policy.schema[(0, change_case_1.camelCase)(model)];
-        });
+        var _a, _b;
+        return this.hasValidation(model) && ((_b = (_a = this.zodSchemas) === null || _a === void 0 ? void 0 : _a.models) === null || _b === void 0 ? void 0 : _b[`${(0, upper_case_first_1.upperCaseFirst)(model)}Schema`]);
     }
     /**
      * Injects model auth guard as where clause.
@@ -133,7 +137,7 @@ class PolicyUtil {
                 //   to-one: direct-conditions/is/isNot
                 yield this.injectGuardForFields(model, args.where, operation);
             }
-            const guard = yield this.getAuthGuard(model, operation);
+            const guard = this.getAuthGuard(model, operation);
             args.where = this.and(args.where, guard);
         });
     }
@@ -158,7 +162,7 @@ class PolicyUtil {
     }
     injectGuardForToManyField(fieldInfo, payload, operation) {
         return __awaiter(this, void 0, void 0, function* () {
-            const guard = yield this.getAuthGuard(fieldInfo.type, operation);
+            const guard = this.getAuthGuard(fieldInfo.type, operation);
             if (payload.some) {
                 yield this.injectGuardForFields(fieldInfo.type, payload.some, operation);
                 // turn "some" into: { some: { AND: [guard, payload.some] } }
@@ -185,7 +189,7 @@ class PolicyUtil {
     }
     injectGuardForToOneField(fieldInfo, payload, operation) {
         return __awaiter(this, void 0, void 0, function* () {
-            const guard = yield this.getAuthGuard(fieldInfo.type, operation);
+            const guard = this.getAuthGuard(fieldInfo.type, operation);
             if (payload.is || payload.isNot) {
                 if (payload.is) {
                     yield this.injectGuardForFields(fieldInfo.type, payload.is, operation);
@@ -228,9 +232,11 @@ class PolicyUtil {
             yield this.injectAuthGuard(args, model, 'read');
             // recursively inject read guard conditions into the query args
             yield this.injectNestedReadConditions(model, args);
-            this.logger.info(`Reading with validation for ${model}: ${(0, utils_1.formatObject)(args)}`);
+            if (this.shouldLogQuery) {
+                this.logger.info(`[withPolicy] \`findMany\`:\n${(0, utils_1.formatObject)(args)}`);
+            }
             const result = yield this.db[model].findMany(args);
-            yield Promise.all(result.map((item) => this.postProcessForRead(item, model, args, 'read')));
+            yield this.postProcessForRead(result, model, args, 'read');
             return result;
         });
     }
@@ -239,9 +245,9 @@ class PolicyUtil {
         var _a;
         return __awaiter(this, void 0, void 0, function* () {
             // e.g.: { a_b: { a: '1', b: '1' } } => { a: '1', b: '1' }
-            const uniqueConstraints = (_a = this.modelMeta.uniqueConstraints) === null || _a === void 0 ? void 0 : _a[(0, change_case_1.camelCase)(model)];
+            const uniqueConstraints = (_a = this.modelMeta.uniqueConstraints) === null || _a === void 0 ? void 0 : _a[(0, lower_case_first_1.lowerCaseFirst)(model)];
             let flattened = false;
-            if (uniqueConstraints) {
+            if (uniqueConstraints && Object.keys(uniqueConstraints).length > 0) {
                 for (const [field, value] of Object.entries(args)) {
                     if (uniqueConstraints[field] && typeof value === 'object') {
                         for (const [f, v] of Object.entries(value)) {
@@ -253,7 +259,8 @@ class PolicyUtil {
                 }
             }
             if (flattened) {
-                this.logger.info(`Filter flattened: ${JSON.stringify(args)}`);
+                // DEBUG
+                // this.logger.info(`Filter flattened: ${JSON.stringify(args)}`);
             }
         });
     }
@@ -264,6 +271,35 @@ class PolicyUtil {
             if (!injectTarget) {
                 return;
             }
+            if (injectTarget._count !== undefined) {
+                // _count needs to respect read policies of related models
+                if (injectTarget._count === true) {
+                    // include count for all relations, expand to all fields
+                    // so that we can inject guard conditions for each of them
+                    injectTarget._count = { select: {} };
+                    const modelFields = (0, model_meta_1.getFields)(this.modelMeta, model);
+                    if (modelFields) {
+                        for (const [k, v] of Object.entries(modelFields)) {
+                            if (v.isDataModel && v.isArray) {
+                                // create an entry for to-many relation
+                                injectTarget._count.select[k] = {};
+                            }
+                        }
+                    }
+                }
+                // inject conditions for each relation
+                for (const field of Object.keys(injectTarget._count.select)) {
+                    if (typeof injectTarget._count.select[field] !== 'object') {
+                        injectTarget._count.select[field] = {};
+                    }
+                    const fieldInfo = (0, model_meta_1.resolveField)(this.modelMeta, model, field);
+                    if (!fieldInfo) {
+                        continue;
+                    }
+                    // inject into the "where" clause inside select
+                    yield this.injectAuthGuard(injectTarget._count.select[field], fieldInfo.type, 'read');
+                }
+            }
             const idFields = this.getIdFields(model);
             for (const field of (0, utils_1.getModelFields)(injectTarget)) {
                 const fieldInfo = (0, model_meta_1.resolveField)(this.modelMeta, model, field);
@@ -301,41 +337,68 @@ class PolicyUtil {
      * (which can't be trimmed at query time) and removes fields that should be
      * omitted.
      */
-    postProcessForRead(entityData, model, args, operation) {
+    postProcessForRead(data, model, args, operation) {
         var _a;
         return __awaiter(this, void 0, void 0, function* () {
-            const ids = this.getEntityIds(model, entityData);
-            if (Object.keys(ids).length === 0) {
-                return;
-            }
-            // strip auxiliary fields
-            for (const auxField of sdk_1.AUXILIARY_FIELDS) {
-                if (auxField in entityData) {
-                    delete entityData[auxField];
-                }
-            }
-            const injectTarget = (_a = args.select) !== null && _a !== void 0 ? _a : args.include;
-            if (!injectTarget) {
-                return;
-            }
-            // to-one relation data cannot be trimmed by injected guards, we have to
-            // post-check them
-            for (const field of (0, utils_1.getModelFields)(injectTarget)) {
-                if (!(entityData === null || entityData === void 0 ? void 0 : entityData[field])) {
+            for (const entityData of (0, utils_1.enumerate)(data)) {
+                if (typeof entityData !== 'object' || !entityData) {
                     continue;
                 }
-                const fieldInfo = (0, model_meta_1.resolveField)(this.modelMeta, model, field);
-                if (!fieldInfo || !fieldInfo.isDataModel || fieldInfo.isArray) {
-                    continue;
+                // strip auxiliary fields
+                for (const auxField of constants_1.AUXILIARY_FIELDS) {
+                    if (auxField in entityData) {
+                        delete entityData[auxField];
+                    }
                 }
-                const ids = this.getEntityIds(fieldInfo.type, entityData[field]);
-                if (Object.keys(ids).length === 0) {
+                const injectTarget = (_a = args.select) !== null && _a !== void 0 ? _a : args.include;
+                if (!injectTarget) {
                     continue;
                 }
-                this.logger.info(`Validating read of to-one relation: ${fieldInfo.type}#${(0, utils_1.formatObject)(ids)}`);
-                yield this.checkPolicyForFilter(fieldInfo.type, ids, operation, this.db);
-                // recurse
-                yield this.postProcessForRead(entityData[field], fieldInfo.type, injectTarget[field], operation);
+                // recurse into nested entities
+                for (const field of Object.keys(injectTarget)) {
+                    const fieldData = entityData[field];
+                    if (typeof fieldData !== 'object' || !fieldData) {
+                        continue;
+                    }
+                    const fieldInfo = (0, model_meta_1.resolveField)(this.modelMeta, model, field);
+                    if (fieldInfo) {
+                        if (fieldInfo.isDataModel && !fieldInfo.isArray) {
+                            // to-one relation data cannot be trimmed by injected guards, we have to
+                            // post-check them
+                            const ids = this.getEntityIds(fieldInfo.type, fieldData);
+                            if (Object.keys(ids).length !== 0) {
+                                // if (this.logger.enabled('info')) {
+                                //     this.logger.info(
+                                //         `Validating read of to-one relation: ${fieldInfo.type}#${formatObject(ids)}`
+                                //     );
+                                // }
+                                try {
+                                    yield this.checkPolicyForFilter(fieldInfo.type, ids, operation, this.db);
+                                }
+                                catch (err) {
+                                    if ((0, error_1.isPrismaClientKnownRequestError)(err) &&
+                                        err.code === constants_1.PrismaErrorCode.CONSTRAINED_FAILED) {
+                                        // denied by policy
+                                        if (fieldInfo.isOptional) {
+                                            // if the relation is optional, just nullify it
+                                            entityData[field] = null;
+                                        }
+                                        else {
+                                            // otherwise reject
+                                            throw err;
+                                        }
+                                    }
+                                    else {
+                                        // unknown error
+                                        throw err;
+                                    }
+                                }
+                            }
+                        }
+                        // recurse
+                        yield this.postProcessForRead(fieldData, fieldInfo.type, injectTarget[field], operation);
+                    }
+                }
             }
         });
     }
@@ -371,17 +434,17 @@ class PolicyUtil {
             }
             // use a transaction to conduct write, so in case any create or nested create
             // fails access policies, we can roll back the entire operation
-            const transactionId = (0, cuid_1.default)();
+            const transactionId = (0, cuid2_1.createId)();
             // args processor for create
             const processCreate = (model, args) => __awaiter(this, void 0, void 0, function* () {
-                const guard = yield this.getAuthGuard(model, 'create');
-                const schema = yield this.getModelSchema(model);
+                const guard = this.getAuthGuard(model, 'create');
+                const schema = this.getModelSchema(model);
                 if (guard === false) {
                     throw this.deniedByPolicy(model, 'create');
                 }
                 else if (guard !== true || schema) {
                     // mark the create with a transaction tag so we can check them later
-                    args[sdk_1.TRANSACTION_FIELD_NAME] = `${transactionId}:create`;
+                    args[constants_1.TRANSACTION_FIELD_NAME] = `${transactionId}:create`;
                     createdModels.add(model);
                 }
             });
@@ -390,10 +453,16 @@ class PolicyUtil {
                 let result, currQuery;
                 let currField;
                 for (let i = context.nestingPath.length - 1; i >= 0; i--) {
-                    const { field, where, unique } = context.nestingPath[i];
+                    const { field, model, where, unique } = context.nestingPath[i];
+                    // never modify the original where because it's shared in the structure
+                    const visitWhere = Object.assign({}, where);
+                    if (model && where) {
+                        // make sure composite unique condition is flattened
+                        yield this.flattenGeneratedUniqueField(model, visitWhere);
+                    }
                     if (!result) {
                         // first segment (bottom), just use its where clause
-                        result = currQuery = Object.assign({}, where);
+                        result = currQuery = Object.assign({}, visitWhere);
                         currField = field;
                     }
                     else {
@@ -403,7 +472,14 @@ class PolicyUtil {
                         if (!currField.backLink) {
                             throw this.unknownError(`field ${currField.type}.${currField.name} doesn't have a backLink`);
                         }
-                        currQuery[currField.backLink] = Object.assign({}, where);
+                        const backLinkField = this.getModelField(currField.type, currField.backLink);
+                        if (backLinkField === null || backLinkField === void 0 ? void 0 : backLinkField.isArray) {
+                            // many-side of relationship, wrap with "some" query
+                            currQuery[currField.backLink] = { some: Object.assign({}, visitWhere) };
+                        }
+                        else {
+                            currQuery[currField.backLink] = Object.assign({}, visitWhere);
+                        }
                         currQuery = currQuery[currField.backLink];
                         currField = field;
                     }
@@ -416,7 +492,7 @@ class PolicyUtil {
             });
             // args processor for update/upsert
             const processUpdate = (model, where, context) => __awaiter(this, void 0, void 0, function* () {
-                const preGuard = yield this.getAuthGuard(model, 'update');
+                const preGuard = this.getAuthGuard(model, 'update');
                 if (preGuard === false) {
                     throw this.deniedByPolicy(model, 'update');
                 }
@@ -467,7 +543,7 @@ class PolicyUtil {
             });
             // args processor for updateMany
             const processUpdateMany = (model, args, context) => __awaiter(this, void 0, void 0, function* () {
-                const guard = yield this.getAuthGuard(model, 'update');
+                const guard = this.getAuthGuard(model, 'update');
                 if (guard === false) {
                     throw this.deniedByPolicy(model, 'update');
                 }
@@ -480,8 +556,8 @@ class PolicyUtil {
             // for models with post-update rules, we need to read and store
             // entity values before the update for post-update check
             const preparePostUpdateCheck = (model, context) => __awaiter(this, void 0, void 0, function* () {
-                const postGuard = yield this.getAuthGuard(model, 'postUpdate');
-                const schema = yield this.getModelSchema(model);
+                const postGuard = this.getAuthGuard(model, 'postUpdate');
+                const schema = this.getModelSchema(model);
                 // post-update check is needed if there's post-update rule or validation schema
                 if (postGuard !== true || schema) {
                     // fetch preValue selection (analyzed from the post-update rules)
@@ -498,7 +574,9 @@ class PolicyUtil {
                         select[idField.name] = true;
                     }
                     const query = { where: filter, select };
-                    this.logger.info(`fetching pre-update entities for ${model}: ${(0, utils_1.formatObject)(query)})}`);
+                    if (this.shouldLogQuery) {
+                        this.logger.info(`[withPolicy] \`findMany\` for fetching pre-update entities:\n${(0, utils_1.formatObject)(args)}`);
+                    }
                     const entities = yield this.db[model].findMany(query);
                     entities.forEach((entity) => {
                         addUpdatedEntity(model, this.getEntityIds(model, entity), entity);
@@ -507,7 +585,7 @@ class PolicyUtil {
             });
             // args processor for delete
             const processDelete = (model, args, context) => __awaiter(this, void 0, void 0, function* () {
-                const guard = yield this.getAuthGuard(model, 'delete');
+                const guard = this.getAuthGuard(model, 'delete');
                 if (guard === false) {
                     throw this.deniedByPolicy(model, 'delete');
                 }
@@ -524,6 +602,8 @@ class PolicyUtil {
             });
             // process relation updates: connect, connectOrCreate, and disconnect
             const processRelationUpdate = (model, args, context) => __awaiter(this, void 0, void 0, function* () {
+                // CHECK ME: equire the entity being connected readable?
+                // await this.checkPolicyForFilter(model, args, 'read', this.db);
                 var _a;
                 if ((_a = context.field) === null || _a === void 0 ? void 0 : _a.backLink) {
                     // fetch the backlink field of the model being connected
@@ -538,66 +618,56 @@ class PolicyUtil {
             // use a visitor to process args before conducting the write action
             const visitor = new nested_write_vistor_1.NestedWriteVisitor(this.modelMeta, {
                 create: (model, args) => __awaiter(this, void 0, void 0, function* () {
-                    for (const oneArgs of (0, utils_1.enumerate)(args)) {
-                        yield processCreate(model, oneArgs);
-                    }
+                    yield processCreate(model, args);
                 }),
                 connectOrCreate: (model, args, context) => __awaiter(this, void 0, void 0, function* () {
-                    for (const oneArgs of (0, utils_1.enumerate)(args)) {
-                        if (oneArgs.create) {
-                            yield processCreate(model, oneArgs.create);
-                        }
-                        if (oneArgs.where) {
-                            yield processRelationUpdate(model, oneArgs.where, context);
-                        }
+                    if (args.create) {
+                        yield processCreate(model, args.create);
+                    }
+                    if (args.where) {
+                        yield processRelationUpdate(model, args.where, context);
                     }
                 }),
                 connect: (model, args, context) => __awaiter(this, void 0, void 0, function* () {
-                    for (const oneArgs of (0, utils_1.enumerate)(args)) {
-                        yield processRelationUpdate(model, oneArgs, context);
-                    }
+                    yield processRelationUpdate(model, args, context);
                 }),
                 disconnect: (model, args, context) => __awaiter(this, void 0, void 0, function* () {
-                    for (const oneArgs of (0, utils_1.enumerate)(args)) {
-                        yield processRelationUpdate(model, oneArgs, context);
-                    }
+                    yield processRelationUpdate(model, args, context);
                 }),
                 update: (model, args, context) => __awaiter(this, void 0, void 0, function* () {
-                    for (const oneArgs of (0, utils_1.enumerate)(args)) {
-                        yield processUpdate(model, oneArgs.where, context);
-                    }
+                    yield processUpdate(model, args.where, context);
                 }),
                 updateMany: (model, args, context) => __awaiter(this, void 0, void 0, function* () {
-                    for (const oneArgs of (0, utils_1.enumerate)(args)) {
-                        yield processUpdateMany(model, oneArgs, context);
-                    }
+                    yield processUpdateMany(model, args, context);
                 }),
                 upsert: (model, args, context) => __awaiter(this, void 0, void 0, function* () {
-                    for (const oneArgs of (0, utils_1.enumerate)(args)) {
-                        if (oneArgs.create) {
-                            yield processCreate(model, oneArgs.create);
-                        }
-                        if (oneArgs.update) {
-                            yield processUpdate(model, oneArgs.where, context);
-                        }
+                    if (args.create) {
+                        yield processCreate(model, args.create);
+                    }
+                    if (args.update) {
+                        yield processUpdate(model, args.where, context);
                     }
                 }),
                 delete: (model, args, context) => __awaiter(this, void 0, void 0, function* () {
-                    for (const oneArgs of (0, utils_1.enumerate)(args)) {
-                        yield processDelete(model, oneArgs, context);
-                    }
+                    yield processDelete(model, args, context);
                 }),
-                deleteMany: (model, args, context) => __awaiter(this, void 0, void 0, function* () {
-                    const guard = yield this.getAuthGuard(model, 'delete');
+                // eslint-disable-next-line @typescript-eslint/no-unused-vars
+                deleteMany: (model, args, _context) => __awaiter(this, void 0, void 0, function* () {
+                    const guard = this.getAuthGuard(model, 'delete');
                     if (guard === false) {
                         throw this.deniedByPolicy(model, 'delete');
                     }
                     else if (guard !== true) {
-                        if (Array.isArray(args)) {
-                            context.parent.deleteMany = args.map((oneArgs) => this.and(oneArgs, guard));
+                        if (args.where) {
+                            args.where = this.and(args.where, guard);
                         }
                         else {
-                            context.parent.deleteMany = this.and(args, guard);
+                            const copy = (0, deepcopy_1.default)(args);
+                            for (const key of Object.keys(args)) {
+                                delete args[key];
+                            }
+                            const combined = this.and(copy, guard);
+                            Object.assign(args, combined);
                         }
                     }
                 }),
@@ -613,7 +683,7 @@ class PolicyUtil {
                     const result = yield writeAction(tx[model], args);
                     if (createdModels.size > 0) {
                         // do post-check on created entities
-                        yield Promise.all([...createdModels].map((model) => this.checkPolicyForFilter(model, { [sdk_1.TRANSACTION_FIELD_NAME]: `${transactionId}:create` }, 'create', tx)));
+                        yield Promise.all([...createdModels].map((model) => this.checkPolicyForFilter(model, { [constants_1.TRANSACTION_FIELD_NAME]: `${transactionId}:create` }, 'create', tx)));
                     }
                     if (updatedModels.size > 0) {
                         // do post-check on updated entities
@@ -626,6 +696,11 @@ class PolicyUtil {
             }
         });
     }
+    getModelField(model, field) {
+        var _a;
+        model = (0, lower_case_first_1.lowerCaseFirst)(model);
+        return (_a = this.modelMeta.fields[model]) === null || _a === void 0 ? void 0 : _a[field];
+    }
     transaction(db, action) {
         if (db.__zenstack_tx) {
             // already in transaction, don't nest
@@ -636,16 +711,16 @@ class PolicyUtil {
         }
     }
     deniedByPolicy(model, operation, extra, reason) {
-        return new runtime_1.PrismaClientKnownRequestError(`denied by policy: ${model} entities failed '${operation}' check${extra ? ', ' + extra : ''}`, { clientVersion: (0, version_1.getVersion)(), code: 'P2004', meta: { reason } });
+        return (0, utils_1.prismaClientKnownRequestError)(this.db, `denied by policy: ${model} entities failed '${operation}' check${extra ? ', ' + extra : ''}`, { clientVersion: (0, version_1.getVersion)(), code: constants_1.PrismaErrorCode.CONSTRAINED_FAILED, meta: { reason } });
     }
     notFound(model) {
-        return new runtime_1.PrismaClientKnownRequestError(`entity not found for model ${model}`, {
+        return (0, utils_1.prismaClientKnownRequestError)(this.db, `entity not found for model ${model}`, {
             clientVersion: (0, version_1.getVersion)(),
             code: 'P2025',
         });
     }
     unknownError(message) {
-        return new runtime_1.PrismaClientUnknownRequestError(message, {
+        return (0, utils_1.prismaClientUnknownRequestError)(this.db, message, {
             clientVersion: (0, version_1.getVersion)(),
         });
     }
@@ -655,37 +730,73 @@ class PolicyUtil {
      */
     checkPolicyForFilter(model, filter, operation, db) {
         return __awaiter(this, void 0, void 0, function* () {
-            this.logger.info(`Checking policy for ${model}#${JSON.stringify(filter)} for ${operation}`);
+            const guard = this.getAuthGuard(model, operation);
+            const schema = (operation === 'create' || operation === 'update') && this.getModelSchema(model);
+            if (guard === true && !schema) {
+                // unconditionally allowed
+                return;
+            }
+            // if (this.logger.enabled('info')) {
+            //     this.logger.info(`Checking policy for ${model}#${JSON.stringify(filter)} for ${operation}`);
+            // }
             const queryFilter = (0, deepcopy_1.default)(filter);
             // query args will be used with findMany, so we need to
             // translate unique constraint filters into a flat filter
             // e.g.: { a_b: { a: '1', b: '1' } } => { a: '1', b: '1' }
             yield this.flattenGeneratedUniqueField(model, queryFilter);
-            const count = (yield db[model].count({ where: queryFilter }));
-            const guard = yield this.getAuthGuard(model, operation);
+            const countArgs = { where: queryFilter };
+            // if (this.shouldLogQuery) {
+            //     this.logger.info(
+            //         `[withPolicy] \`count\` for policy check without guard:\n${formatObject(countArgs)}`
+            //     );
+            // }
+            const count = (yield db[model].count(countArgs));
+            if (count === 0) {
+                // there's nothing to filter out
+                return;
+            }
+            if (guard === false) {
+                // unconditionally denied
+                throw this.deniedByPolicy(model, operation, `${count} ${(0, pluralize_1.default)('entity', count)} failed policy check`);
+            }
             // build a query condition with policy injected
             const guardedQuery = { where: this.and(queryFilter, guard) };
-            const schema = (operation === 'create' || operation === 'update') && (yield this.getModelSchema(model));
             if (schema) {
                 // we've got schemas, so have to fetch entities and validate them
+                // if (this.shouldLogQuery) {
+                //     this.logger.info(
+                //         `[withPolicy] \`findMany\` for policy check with guard:\n${formatObject(countArgs)}`
+                //     );
+                // }
                 const entities = yield db[model].findMany(guardedQuery);
                 if (entities.length < count) {
-                    this.logger.info(`entity ${model} failed policy check for operation ${operation}`);
+                    if (this.logger.enabled('info')) {
+                        this.logger.info(`entity ${model} failed policy check for operation ${operation}`);
+                    }
                     throw this.deniedByPolicy(model, operation, `${count - entities.length} ${(0, pluralize_1.default)('entity', count - entities.length)} failed policy check`);
                 }
                 // TODO: push down schema check to the database
                 const schemaCheckErrors = entities.map((entity) => schema.safeParse(entity)).filter((r) => !r.success);
                 if (schemaCheckErrors.length > 0) {
                     const error = schemaCheckErrors.map((r) => !r.success && (0, zod_validation_error_1.fromZodError)(r.error).message).join(', ');
-                    this.logger.info(`entity ${model} failed schema check for operation ${operation}: ${error}`);
-                    throw this.deniedByPolicy(model, operation, `entities failed schema check: [${error}]`);
+                    if (this.logger.enabled('info')) {
+                        this.logger.info(`entity ${model} failed schema check for operation ${operation}: ${error}`);
+                    }
+                    throw this.deniedByPolicy(model, operation, `entities failed schema check: [${error}]`, constants_1.CrudFailureReason.DATA_VALIDATION_VIOLATION);
                 }
             }
             else {
                 // count entities with policy injected and see if any of them are filtered out
+                // if (this.shouldLogQuery) {
+                //     this.logger.info(
+                //         `[withPolicy] \`count\` for policy check with guard:\n${formatObject(guardedQuery)}`
+                //     );
+                // }
                 const guardedCount = (yield db[model].count(guardedQuery));
                 if (guardedCount < count) {
-                    this.logger.info(`entity ${model} failed policy check for operation ${operation}`);
+                    if (this.logger.enabled('info')) {
+                        this.logger.info(`entity ${model} failed policy check for operation ${operation}`);
+                    }
                     throw this.deniedByPolicy(model, operation, `${count - guardedCount} ${(0, pluralize_1.default)('entity', count - guardedCount)} failed policy check`);
                 }
             }
@@ -693,24 +804,30 @@ class PolicyUtil {
     }
     checkPostUpdate(model, ids, db, preValue) {
         return __awaiter(this, void 0, void 0, function* () {
-            this.logger.info(`Checking post-update policy for ${model}#${ids}, preValue: ${(0, utils_1.formatObject)(preValue)}`);
-            const guard = yield this.getAuthGuard(model, 'postUpdate', preValue);
+            // if (this.logger.enabled('info')) {
+            //     this.logger.info(`Checking post-update policy for ${model}#${ids}, preValue: ${formatObject(preValue)}`);
+            // }
+            const guard = this.getAuthGuard(model, 'postUpdate', preValue);
             // build a query condition with policy injected
             const guardedQuery = { where: this.and(ids, guard) };
             // query with policy injected
             const entity = yield db[model].findFirst(guardedQuery);
             // see if we get fewer items with policy, if so, reject with an throw
             if (!entity) {
-                this.logger.info(`entity ${model} failed policy check for operation postUpdate`);
+                if (this.logger.enabled('info')) {
+                    this.logger.info(`entity ${model} failed policy check for operation postUpdate`);
+                }
                 throw this.deniedByPolicy(model, 'postUpdate');
             }
             // TODO: push down schema check to the database
-            const schema = yield this.getModelSchema(model);
+            const schema = this.getModelSchema(model);
             if (schema) {
                 const schemaCheckResult = schema.safeParse(entity);
                 if (!schemaCheckResult.success) {
                     const error = (0, zod_validation_error_1.fromZodError)(schemaCheckResult.error).message;
-                    this.logger.info(`entity ${model} failed schema check for operation postUpdate: ${error}`);
+                    if (this.logger.enabled('info')) {
+                        this.logger.info(`entity ${model} failed schema check for operation postUpdate: ${error}`);
+                    }
                     throw this.deniedByPolicy(model, 'postUpdate', `entity failed schema check: ${error}`);
                 }
             }
@@ -729,15 +846,7 @@ class PolicyUtil {
      * Gets "id" field for a given model.
      */
     getIdFields(model) {
-        const fields = this.modelMeta.fields[(0, change_case_1.camelCase)(model)];
-        if (!fields) {
-            throw this.unknownError(`Unable to load fields for ${model}`);
-        }
-        const result = Object.values(fields).filter((f) => f.isId);
-        if (result.length === 0) {
-            throw this.unknownError(`model ${model} does not have an id field`);
-        }
-        return result;
+        return (0, utils_1.getIdFields)(this.modelMeta, model, true);
     }
     /**
      * Gets id field value from an entity.
@@ -750,6 +859,9 @@ class PolicyUtil {
         }
         return result;
     }
+    get shouldLogQuery() {
+        return this.logPrismaQuery && this.logger.enabled('info');
+    }
 }
 exports.PolicyUtil = PolicyUtil;
 //# sourceMappingURL=policy-utils.js.map