@zenstackhq/runtime 1.0.0-beta.2 → 1.0.0-beta.20

package/enhancements/policy/handler.js

@@ -9,9 +9,25 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
         step((generator = generator.apply(thisArg, _arguments || [])).next());
     });
 };
+var __rest = (this && this.__rest) || function (s, e) {
+    var t = {};
+    for (var p in s) if (Object.prototype.hasOwnProperty.call(s, p) && e.indexOf(p) < 0)
+        t[p] = s[p];
+    if (s != null && typeof Object.getOwnPropertySymbols === "function")
+        for (var i = 0, p = Object.getOwnPropertySymbols(s); i < p.length; i++) {
+            if (e.indexOf(p[i]) < 0 && Object.prototype.propertyIsEnumerable.call(s, p[i]))
+                t[p[i]] = s[p[i]];
+        }
+    return t;
+};
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.PolicyProxyHandler = void 0;
+const upper_case_first_1 = require("upper-case-first");
+const zod_validation_error_1 = require("zod-validation-error");
 const constants_1 = require("../../constants");
+const model_data_visitor_1 = require("../model-data-visitor");
+const model_meta_1 = require("../model-meta");
+const nested_write_vistor_1 = require("../nested-write-vistor");
 const utils_1 = require("../utils");
 const logger_1 = require("./logger");
 const policy_utils_1 = require("./policy-utils");
@@ -19,21 +35,23 @@ const policy_utils_1 = require("./policy-utils");
  * Prisma proxy handler for injecting access policy check.
  */
 class PolicyProxyHandler {
-    constructor(prisma, policy, modelMeta, model, user, logPrismaQuery) {
+    constructor(prisma, policy, modelMeta, zodSchemas, model, user, logPrismaQuery) {
         this.prisma = prisma;
         this.policy = policy;
         this.modelMeta = modelMeta;
+        this.zodSchemas = zodSchemas;
         this.model = model;
         this.user = user;
         this.logPrismaQuery = logPrismaQuery;
         this.logger = new logger_1.Logger(prisma);
-        this.utils = new policy_utils_1.PolicyUtil(this.prisma, this.modelMeta, this.policy, this.user, this.logPrismaQuery);
+        this.utils = new policy_utils_1.PolicyUtil(this.prisma, this.modelMeta, this.policy, this.zodSchemas, this.user, this.shouldLogQuery);
     }
     get modelClient() {
         return this.prisma[this.model];
     }
+    //#region Find
+    // find operations behaves as if the entities that don't match access policies don't exist
     findUnique(args) {
-        var _a;
         return __awaiter(this, void 0, void 0, function* () {
             if (!args) {
                 throw (0, utils_1.prismaClientValidationError)(this.prisma, 'query argument is required');
@@ -41,60 +59,92 @@ class PolicyProxyHandler {
             if (!args.where) {
                 throw (0, utils_1.prismaClientValidationError)(this.prisma, 'where field is required in query argument');
             }
-            const guard = yield this.utils.getAuthGuard(this.model, 'read');
-            if (guard === false) {
+            const origArgs = args;
+            args = this.utils.clone(args);
+            if (!(yield this.utils.injectForRead(this.prisma, this.model, args))) {
                 return null;
             }
-            const entities = yield this.utils.readWithCheck(this.model, args);
-            return (_a = entities[0]) !== null && _a !== void 0 ? _a : null;
+            this.utils.injectReadCheckSelect(this.model, args);
+            if (this.shouldLogQuery) {
+                this.logger.info(`[policy] \`findUnique\` ${this.model}:\n${(0, utils_1.formatObject)(args)}`);
+            }
+            const result = yield this.modelClient.findUnique(args);
+            this.utils.postProcessForRead(result, this.model, origArgs);
+            return result;
         });
     }
     findUniqueOrThrow(args) {
         return __awaiter(this, void 0, void 0, function* () {
-            const guard = yield this.utils.getAuthGuard(this.model, 'read');
-            if (guard === false) {
-                throw this.utils.notFound(this.model);
+            if (!args) {
+                throw (0, utils_1.prismaClientValidationError)(this.prisma, 'query argument is required');
+            }
+            if (!args.where) {
+                throw (0, utils_1.prismaClientValidationError)(this.prisma, 'where field is required in query argument');
             }
-            const entity = yield this.findUnique(args);
-            if (!entity) {
+            const origArgs = args;
+            args = this.utils.clone(args);
+            if (!(yield this.utils.injectForRead(this.prisma, this.model, args))) {
                 throw this.utils.notFound(this.model);
             }
-            return entity;
+            this.utils.injectReadCheckSelect(this.model, args);
+            if (this.shouldLogQuery) {
+                this.logger.info(`[policy] \`findUniqueOrThrow\` ${this.model}:\n${(0, utils_1.formatObject)(args)}`);
+            }
+            const result = yield this.modelClient.findUniqueOrThrow(args);
+            this.utils.postProcessForRead(result, this.model, origArgs);
+            return result;
         });
     }
     findFirst(args) {
-        var _a;
         return __awaiter(this, void 0, void 0, function* () {
-            const guard = yield this.utils.getAuthGuard(this.model, 'read');
-            if (guard === false) {
+            const origArgs = args;
+            args = args ? this.utils.clone(args) : {};
+            if (!(yield this.utils.injectForRead(this.prisma, this.model, args))) {
                 return null;
             }
-            const entities = yield this.utils.readWithCheck(this.model, args);
-            return (_a = entities[0]) !== null && _a !== void 0 ? _a : null;
+            this.utils.injectReadCheckSelect(this.model, args);
+            if (this.shouldLogQuery) {
+                this.logger.info(`[policy] \`findFirst\` ${this.model}:\n${(0, utils_1.formatObject)(args)}`);
+            }
+            const result = yield this.modelClient.findFirst(args);
+            this.utils.postProcessForRead(result, this.model, origArgs);
+            return result;
         });
     }
     findFirstOrThrow(args) {
         return __awaiter(this, void 0, void 0, function* () {
-            const guard = yield this.utils.getAuthGuard(this.model, 'read');
-            if (guard === false) {
+            const origArgs = args;
+            args = args ? this.utils.clone(args) : {};
+            if (!(yield this.utils.injectForRead(this.prisma, this.model, args))) {
                 throw this.utils.notFound(this.model);
             }
-            const entity = yield this.findFirst(args);
-            if (!entity) {
-                throw this.utils.notFound(this.model);
+            this.utils.injectReadCheckSelect(this.model, args);
+            if (this.shouldLogQuery) {
+                this.logger.info(`[policy] \`findFirstOrThrow\` ${this.model}:\n${(0, utils_1.formatObject)(args)}`);
             }
-            return entity;
+            const result = yield this.modelClient.findFirstOrThrow(args);
+            this.utils.postProcessForRead(result, this.model, origArgs);
+            return result;
         });
     }
     findMany(args) {
         return __awaiter(this, void 0, void 0, function* () {
-            const guard = yield this.utils.getAuthGuard(this.model, 'read');
-            if (guard === false) {
+            const origArgs = args;
+            args = args ? this.utils.clone(args) : {};
+            if (!(yield this.utils.injectForRead(this.prisma, this.model, args))) {
                 return [];
             }
-            return this.utils.readWithCheck(this.model, args);
+            this.utils.injectReadCheckSelect(this.model, args);
+            if (this.shouldLogQuery) {
+                this.logger.info(`[policy] \`findMany\` ${this.model}:\n${(0, utils_1.formatObject)(args)}`);
+            }
+            const result = yield this.modelClient.findMany(args);
+            this.utils.postProcessForRead(result, this.model, origArgs);
+            return result;
         });
     }
+    //#endregion
+    //#region Create
     create(args) {
         return __awaiter(this, void 0, void 0, function* () {
             if (!args) {
@@ -103,45 +153,316 @@ class PolicyProxyHandler {
             if (!args.data) {
                 throw (0, utils_1.prismaClientValidationError)(this.prisma, 'data field is required in query argument');
             }
-            yield this.tryReject('create');
+            yield this.utils.tryReject(this.prisma, this.model, 'create');
             const origArgs = args;
             args = this.utils.clone(args);
-            // use a transaction to wrap the write so it can be reverted if the created
-            // entity fails access policies
-            const result = yield this.utils.processWrite(this.model, 'create', args, (dbOps, writeArgs) => {
-                if (this.shouldLogQuery) {
-                    this.logger.info(`[withPolicy] \`create\`: ${(0, utils_1.formatObject)(writeArgs)}`);
+            // static input policy check for top-level create data
+            const inputCheck = this.utils.checkInputGuard(this.model, args.data, 'create');
+            if (inputCheck === false) {
+                throw this.utils.deniedByPolicy(this.model, 'create');
+            }
+            const hasNestedCreateOrConnect = yield this.hasNestedCreateOrConnect(args);
+            const { result, error } = yield this.transaction((tx) => __awaiter(this, void 0, void 0, function* () {
+                if (
+                // MUST check true here since inputCheck can be undefined (meaning static input check not possible)
+                inputCheck === true &&
+                    // simple create: no nested create/connect
+                    !hasNestedCreateOrConnect) {
+                    // there's no nested write and we've passed input check, proceed with the create directly
+                    // validate zod schema if any
+                    this.validateCreateInputSchema(this.model, args.data);
+                    // make a create args only containing data and ID selection
+                    const createArgs = { data: args.data, select: this.utils.makeIdSelection(this.model) };
+                    if (this.shouldLogQuery) {
+                        this.logger.info(`[policy] \`create\` ${this.model}: ${(0, utils_1.formatObject)(createArgs)}`);
+                    }
+                    const result = yield tx[this.model].create(createArgs);
+                    // filter the read-back data
+                    return this.utils.readBack(tx, this.model, 'create', args, result);
                 }
-                return dbOps.create(writeArgs);
+                else {
+                    // proceed with a complex create and collect post-write checks
+                    const { result, postWriteChecks } = yield this.doCreate(this.model, args, tx);
+                    // execute post-write checks
+                    yield this.runPostWriteChecks(postWriteChecks, tx);
+                    // filter the read-back data
+                    return this.utils.readBack(tx, this.model, 'create', origArgs, result);
+                }
+            }));
+            if (error) {
+                throw error;
+            }
+            else {
+                return result;
+            }
+        });
+    }
+    // create with nested write
+    doCreate(model, args, db) {
+        return __awaiter(this, void 0, void 0, function* () {
+            // record id fields involved in the nesting context
+            const idSelections = [];
+            const pushIdFields = (model, context) => {
+                const idFields = (0, utils_1.getIdFields)(this.modelMeta, model);
+                idSelections.push({
+                    path: context.nestingPath.map((p) => p.field).filter((f) => !!f),
+                    ids: idFields.map((f) => f.name),
+                });
+            };
+            // create a string key that uniquely identifies an entity
+            const getEntityKey = (model, ids) => `${(0, upper_case_first_1.upperCaseFirst)(model)}#${Object.keys(ids)
+                .sort()
+                .map((f) => { var _a; return `${f}:${(_a = ids[f]) === null || _a === void 0 ? void 0 : _a.toString()}`; })
+                .join('_')}`;
+            // record keys of entities that are connected instead of created
+            const connectedEntities = new Set();
+            // visit the create payload
+            const visitor = new nested_write_vistor_1.NestedWriteVisitor(this.modelMeta, {
+                create: (model, args, context) => __awaiter(this, void 0, void 0, function* () {
+                    this.validateCreateInputSchema(model, args);
+                    pushIdFields(model, context);
+                }),
+                createMany: (model, args, context) => __awaiter(this, void 0, void 0, function* () {
+                    (0, utils_1.enumerate)(args.data).forEach((item) => this.validateCreateInputSchema(model, item));
+                    pushIdFields(model, context);
+                }),
+                connectOrCreate: (model, args, context) => __awaiter(this, void 0, void 0, function* () {
+                    var _a;
+                    if (!args.where) {
+                        throw this.utils.validationError(`'where' field is required for connectOrCreate`);
+                    }
+                    this.validateCreateInputSchema(model, args.create);
+                    const existing = yield this.utils.checkExistence(db, model, args.where);
+                    if (existing) {
+                        // connect case
+                        if ((_a = context.field) === null || _a === void 0 ? void 0 : _a.backLink) {
+                            const backLinkField = (0, model_meta_1.resolveField)(this.modelMeta, model, context.field.backLink);
+                            if (backLinkField === null || backLinkField === void 0 ? void 0 : backLinkField.isRelationOwner) {
+                                // the target side of relation owns the relation,
+                                // check if it's updatable
+                                yield this.utils.checkPolicyForUnique(model, args.where, 'update', db, args);
+                            }
+                        }
+                        if (context.parent.connect) {
+                            // if the payload parent already has a "connect" clause, merge it
+                            if (Array.isArray(context.parent.connect)) {
+                                context.parent.connect.push(args.where);
+                            }
+                            else {
+                                context.parent.connect = [context.parent.connect, args.where];
+                            }
+                        }
+                        else {
+                            // otherwise, create a new "connect" clause
+                            context.parent.connect = args.where;
+                        }
+                        // record the key of connected entities so we can avoid validating them later
+                        connectedEntities.add(getEntityKey(model, existing));
+                    }
+                    else {
+                        // create case
+                        pushIdFields(model, context);
+                        // create a new "create" clause at the parent level
+                        context.parent.create = args.create;
+                    }
+                    // remove the connectOrCreate clause
+                    delete context.parent['connectOrCreate'];
+                    // return false to prevent visiting the nested payload
+                    return false;
+                }),
+                connect: (model, args, context) => __awaiter(this, void 0, void 0, function* () {
+                    var _b;
+                    if (!args || typeof args !== 'object' || Object.keys(args).length === 0) {
+                        throw this.utils.validationError(`'connect' field must be an non-empty object`);
+                    }
+                    if ((_b = context.field) === null || _b === void 0 ? void 0 : _b.backLink) {
+                        const backLinkField = (0, model_meta_1.resolveField)(this.modelMeta, model, context.field.backLink);
+                        if (backLinkField === null || backLinkField === void 0 ? void 0 : backLinkField.isRelationOwner) {
+                            // check existence
+                            yield this.utils.checkExistence(db, model, args, true);
+                            // the target side of relation owns the relation,
+                            // check if it's updatable
+                            yield this.utils.checkPolicyForUnique(model, args, 'update', db, args);
+                        }
+                    }
+                }),
             });
+            yield visitor.visit(model, 'create', args);
+            // build the final "select" clause including all nested ID fields
+            let select = undefined;
+            if (idSelections.length > 0) {
+                select = {};
+                idSelections.forEach(({ path, ids }) => {
+                    let curr = select;
+                    for (const p of path) {
+                        if (!curr[p.name]) {
+                            curr[p.name] = { select: {} };
+                        }
+                        curr = curr[p.name].select;
+                    }
+                    Object.assign(curr, ...ids.map((f) => ({ [f]: true })));
+                });
+            }
+            // proceed with the create
+            const createArgs = { data: args.data, select };
+            if (this.shouldLogQuery) {
+                this.logger.info(`[policy] \`create\` ${model}: ${(0, utils_1.formatObject)(createArgs)}`);
+            }
+            const result = yield db[model].create(createArgs);
+            // post create policy check for the top-level and nested creates
+            const postCreateChecks = new Map();
+            // visit the create result and collect entities that need to be post-checked
+            const modelDataVisitor = new model_data_visitor_1.ModelDataVisitor(this.modelMeta);
+            modelDataVisitor.visit(model, result, (model, _data, scalarData) => {
+                const key = getEntityKey(model, scalarData);
+                // only check if entity is created, not connected
+                if (!connectedEntities.has(key) && !postCreateChecks.has(key)) {
+                    postCreateChecks.set(key, { model, operation: 'create', uniqueFilter: scalarData });
+                }
+            });
+            // return only the ids of the top-level entity
             const ids = this.utils.getEntityIds(this.model, result);
-            if (Object.keys(ids).length === 0) {
-                throw this.utils.unknownError(`unexpected error: create didn't return an id`);
-            }
-            return this.checkReadback(origArgs, ids, 'create', 'create');
+            return { result: ids, postWriteChecks: [...postCreateChecks.values()] };
+        });
+    }
+    // Checks if the given create payload has nested create or connect
+    hasNestedCreateOrConnect(args) {
+        return __awaiter(this, void 0, void 0, function* () {
+            let hasNestedCreateOrConnect = false;
+            const visitor = new nested_write_vistor_1.NestedWriteVisitor(this.modelMeta, {
+                create(_model, _args, context) {
+                    return __awaiter(this, void 0, void 0, function* () {
+                        if (context.field) {
+                            hasNestedCreateOrConnect = true;
+                            return false;
+                        }
+                        else {
+                            return true;
+                        }
+                    });
+                },
+                connect() {
+                    return __awaiter(this, void 0, void 0, function* () {
+                        hasNestedCreateOrConnect = true;
+                        return false;
+                    });
+                },
+                connectOrCreate() {
+                    return __awaiter(this, void 0, void 0, function* () {
+                        hasNestedCreateOrConnect = true;
+                        return false;
+                    });
+                },
+                createMany() {
+                    return __awaiter(this, void 0, void 0, function* () {
+                        hasNestedCreateOrConnect = true;
+                        return false;
+                    });
+                },
+            });
+            yield visitor.visit(this.model, 'create', args);
+            return hasNestedCreateOrConnect;
         });
     }
-    createMany(args, skipDuplicates) {
+    // Validates the given create payload against Zod schema if any
+    validateCreateInputSchema(model, data) {
+        const schema = this.utils.getZodSchema(model, 'create');
+        if (schema) {
+            const parseResult = schema.safeParse(data);
+            if (!parseResult.success) {
+                throw this.utils.deniedByPolicy(model, 'create', `input failed validation: ${(0, zod_validation_error_1.fromZodError)(parseResult.error)}`, constants_1.CrudFailureReason.DATA_VALIDATION_VIOLATION);
+            }
+        }
+    }
+    createMany(args) {
         return __awaiter(this, void 0, void 0, function* () {
             if (!args) {
                 throw (0, utils_1.prismaClientValidationError)(this.prisma, 'query argument is required');
             }
             if (!args.data) {
-                throw (0, utils_1.prismaClientValidationError)(this.prisma, 'data field is required and must be an array');
+                throw (0, utils_1.prismaClientValidationError)(this.prisma, 'data field is required in query argument');
             }
-            yield this.tryReject('create');
+            this.utils.tryReject(this.prisma, this.model, 'create');
             args = this.utils.clone(args);
-            // use a transaction to wrap the write so it can be reverted if any created
-            // entity fails access policies
-            const result = yield this.utils.processWrite(this.model, 'create', args, (dbOps, writeArgs) => {
+            // do static input validation and check if post-create checks are needed
+            let needPostCreateCheck = false;
+            for (const item of (0, utils_1.enumerate)(args.data)) {
+                const inputCheck = this.utils.checkInputGuard(this.model, item, 'create');
+                if (inputCheck === false) {
+                    throw this.utils.deniedByPolicy(this.model, 'create');
+                }
+                else if (inputCheck === true) {
+                    this.validateCreateInputSchema(this.model, item);
+                }
+                else if (inputCheck === undefined) {
+                    // static policy check is not possible, need to do post-create check
+                    needPostCreateCheck = true;
+                    break;
+                }
+            }
+            if (!needPostCreateCheck) {
+                return this.modelClient.createMany(args);
+            }
+            else {
+                // create entities in a transaction with post-create checks
+                return this.transaction((tx) => __awaiter(this, void 0, void 0, function* () {
+                    const { result, postWriteChecks } = yield this.doCreateMany(this.model, args, tx);
+                    // post-create check
+                    yield this.runPostWriteChecks(postWriteChecks, tx);
+                    return result;
+                }));
+            }
+        });
+    }
+    doCreateMany(model, args, db) {
+        return __awaiter(this, void 0, void 0, function* () {
+            // We can't call the native "createMany" because we can't get back what was created
+            // for post-create checks. Instead, do a "create" for each item and collect the results.
+            let createResult = yield Promise.all((0, utils_1.enumerate)(args.data).map((item) => __awaiter(this, void 0, void 0, function* () {
+                if (args.skipDuplicates) {
+                    // check unique constraint conflicts
+                    // we can't rely on try/catch/ignore constraint violation error: https://github.com/prisma/prisma/issues/20496
+                    // TODO: for simple cases we should be able to translate it to an `upsert` with empty `update` payload
+                    // for each unique constraint, check if the input item has all fields set, and if so, check if
+                    // an entity already exists, and ignore accordingly
+                    const uniqueConstraints = this.utils.getUniqueConstraints(model);
+                    for (const constraint of Object.values(uniqueConstraints)) {
+                        if (constraint.fields.every((f) => item[f] !== undefined)) {
+                            const uniqueFilter = constraint.fields.reduce((acc, f) => (Object.assign(Object.assign({}, acc), { [f]: item[f] })), {});
+                            const existing = yield this.utils.checkExistence(db, model, uniqueFilter);
+                            if (existing) {
+                                if (this.shouldLogQuery) {
+                                    this.logger.info(`[policy] skipping duplicate ${(0, utils_1.formatObject)(item)}`);
+                                }
+                                return undefined;
+                            }
+                        }
+                    }
+                }
                 if (this.shouldLogQuery) {
-                    this.logger.info(`[withPolicy] \`createMany\`: ${(0, utils_1.formatObject)(writeArgs)}`);
+                    this.logger.info(`[policy] \`create\` ${model}: ${(0, utils_1.formatObject)(item)}`);
                 }
-                return dbOps.createMany(writeArgs, skipDuplicates);
-            });
-            return result;
+                return yield db[model].create({ select: this.utils.makeIdSelection(model), data: item });
+            })));
+            // filter undefined values due to skipDuplicates
+            createResult = createResult.filter((p) => !!p);
+            return {
+                result: { count: createResult.length },
+                postWriteChecks: createResult.map((item) => ({
+                    model,
+                    operation: 'create',
+                    uniqueFilter: item,
+                })),
+            };
         });
     }
+    //#endregion
+    //#region Update & Upsert
+    // "update" and "upsert" work against unique entity, so we actively rejects the request if the
+    // entity fails policy check
+    //
+    // "updateMany" works against a set of entities, entities not passing policy check are silently
+    // ignored
     update(args) {
         return __awaiter(this, void 0, void 0, function* () {
             if (!args) {
@@ -153,22 +474,259 @@ class PolicyProxyHandler {
             if (!args.data) {
                 throw (0, utils_1.prismaClientValidationError)(this.prisma, 'data field is required in query argument');
             }
-            yield this.tryReject('update');
-            const origArgs = args;
             args = this.utils.clone(args);
-            // use a transaction to wrap the write so it can be reverted if any nested
-            // create fails access policies
-            const result = yield this.utils.processWrite(this.model, 'update', args, (dbOps, writeArgs) => {
-                if (this.shouldLogQuery) {
-                    this.logger.info(`[withPolicy] \`update\`: ${(0, utils_1.formatObject)(writeArgs)}`);
+            const { result, error } = yield this.transaction((tx) => __awaiter(this, void 0, void 0, function* () {
+                // proceed with nested writes and collect post-write checks
+                const { result, postWriteChecks } = yield this.doUpdate(args, tx);
+                // post-write check
+                yield this.runPostWriteChecks(postWriteChecks, tx);
+                // filter the read-back data
+                return this.utils.readBack(tx, this.model, 'update', args, result);
+            }));
+            if (error) {
+                throw error;
+            }
+            else {
+                return result;
+            }
+        });
+    }
+    doUpdate(args, db) {
+        return __awaiter(this, void 0, void 0, function* () {
+            // collected post-update checks
+            const postWriteChecks = [];
+            // registers a post-update check task
+            const _registerPostUpdateCheck = (model, uniqueFilter) => __awaiter(this, void 0, void 0, function* () {
+                // both "post-update" rules and Zod schemas require a post-update check
+                if (this.utils.hasAuthGuard(model, 'postUpdate') || this.utils.getZodSchema(model)) {
+                    // select pre-update field values
+                    let preValue;
+                    const preValueSelect = this.utils.getPreValueSelect(model);
+                    if (preValueSelect && Object.keys(preValueSelect).length > 0) {
+                        preValue = yield db[model].findFirst({ where: uniqueFilter, select: preValueSelect });
+                    }
+                    postWriteChecks.push({ model, operation: 'postUpdate', uniqueFilter, preValue });
                 }
-                return dbOps.update(writeArgs);
             });
-            const ids = this.utils.getEntityIds(this.model, result);
-            if (Object.keys(ids).length === 0) {
-                throw this.utils.unknownError(`unexpected error: update didn't return an id`);
+            // We can't let the native "update" to handle nested "create" because we can't get back what
+            // was created for doing post-update checks.
+            // Instead, handle nested create inside update as an atomic operation that creates an entire
+            // subtree (containing nested creates/connects)
+            const _create = (model, args, context) => __awaiter(this, void 0, void 0, function* () {
+                var _a;
+                let createData = args;
+                if ((_a = context.field) === null || _a === void 0 ? void 0 : _a.backLink) {
+                    // handles the connection to upstream entity
+                    const reversedQuery = yield this.utils.buildReversedQuery(context);
+                    if (reversedQuery[context.field.backLink]) {
+                        // the built reverse query contains a condition for the backlink field, build a "connect" with it
+                        createData = Object.assign(Object.assign({}, createData), { [context.field.backLink]: {
+                                connect: reversedQuery[context.field.backLink],
+                            } });
+                    }
+                    else {
+                        // otherwise, the reverse query is translated to foreign key setting, merge it to the create data
+                        createData = Object.assign(Object.assign({}, createData), reversedQuery);
+                    }
+                }
+                // proceed with the create and collect post-create checks
+                const { postWriteChecks: checks } = yield this.doCreate(model, { data: createData }, db);
+                postWriteChecks.push(...checks);
+            });
+            const _createMany = (model, args, context) => __awaiter(this, void 0, void 0, function* () {
+                var _b;
+                if ((_b = context.field) === null || _b === void 0 ? void 0 : _b.backLink) {
+                    // handles the connection to upstream entity
+                    const reversedQuery = yield this.utils.buildReversedQuery(context);
+                    for (const item of (0, utils_1.enumerate)(args.data)) {
+                        Object.assign(item, reversedQuery);
+                    }
+                }
+                // proceed with the create and collect post-create checks
+                const { postWriteChecks: checks } = yield this.doCreateMany(model, args, db);
+                postWriteChecks.push(...checks);
+            });
+            const _connectDisconnect = (model, args, context) => __awaiter(this, void 0, void 0, function* () {
+                var _c;
+                if ((_c = context.field) === null || _c === void 0 ? void 0 : _c.backLink) {
+                    const backLinkField = this.utils.getModelField(model, context.field.backLink);
+                    if (backLinkField.isRelationOwner) {
+                        // update happens on the related model, require updatable
+                        yield this.utils.checkPolicyForUnique(model, args, 'update', db, args);
+                        // register post-update check
+                        yield _registerPostUpdateCheck(model, args);
+                    }
+                }
+            });
+            // visit nested writes
+            const visitor = new nested_write_vistor_1.NestedWriteVisitor(this.modelMeta, {
+                update: (model, args, context) => __awaiter(this, void 0, void 0, function* () {
+                    var _d;
+                    // build a unique query including upstream conditions
+                    const uniqueFilter = yield this.utils.buildReversedQuery(context);
+                    // handle not-found
+                    const existing = yield this.utils.checkExistence(db, model, uniqueFilter, true);
+                    // check if the update actually writes to this model
+                    let thisModelUpdate = false;
+                    const updatePayload = (_d = args.data) !== null && _d !== void 0 ? _d : args;
+                    if (updatePayload) {
+                        for (const key of Object.keys(updatePayload)) {
+                            const field = (0, model_meta_1.resolveField)(this.modelMeta, model, key);
+                            if (field) {
+                                if (!field.isDataModel) {
+                                    // scalar field, require this model to be updatable
+                                    thisModelUpdate = true;
+                                    break;
+                                }
+                                else if (field.isRelationOwner) {
+                                    // relation is being updated and this model owns foreign key, require updatable
+                                    thisModelUpdate = true;
+                                    break;
+                                }
+                            }
+                        }
+                    }
+                    if (thisModelUpdate) {
+                        this.utils.tryReject(db, this.model, 'update');
+                        // check pre-update guard
+                        yield this.utils.checkPolicyForUnique(model, uniqueFilter, 'update', db, args);
+                        // handles the case where id fields are updated
+                        const ids = this.utils.clone(existing);
+                        for (const key of Object.keys(existing)) {
+                            const updateValue = args.data ? args.data[key] : args[key];
+                            if (typeof updateValue === 'string' ||
+                                typeof updateValue === 'number' ||
+                                typeof updateValue === 'bigint') {
+                                ids[key] = updateValue;
+                            }
+                        }
+                        // register post-update check
+                        yield _registerPostUpdateCheck(model, ids);
+                    }
+                }),
+                updateMany: (model, args, context) => __awaiter(this, void 0, void 0, function* () {
+                    // injects auth guard into where clause
+                    yield this.utils.injectAuthGuard(db, args, model, 'update');
+                    // prepare for post-update check
+                    if (this.utils.hasAuthGuard(model, 'postUpdate') || this.utils.getZodSchema(model)) {
+                        let select = this.utils.makeIdSelection(model);
+                        const preValueSelect = this.utils.getPreValueSelect(model);
+                        if (preValueSelect) {
+                            select = Object.assign(Object.assign({}, select), preValueSelect);
+                        }
+                        const reversedQuery = yield this.utils.buildReversedQuery(context);
+                        const currentSetQuery = { select, where: reversedQuery };
+                        yield this.utils.injectAuthGuard(db, currentSetQuery, model, 'read');
+                        if (this.shouldLogQuery) {
+                            this.logger.info(`[policy] \`findMany\` ${model}:\n${(0, utils_1.formatObject)(currentSetQuery)}`);
+                        }
+                        const currentSet = yield db[model].findMany(currentSetQuery);
+                        postWriteChecks.push(...currentSet.map((preValue) => ({
+                            model,
+                            operation: 'postUpdate',
+                            uniqueFilter: preValue,
+                            preValue: preValueSelect ? preValue : undefined,
+                        })));
+                    }
+                }),
+                create: (model, args, context) => __awaiter(this, void 0, void 0, function* () {
+                    // process the entire create subtree separately
+                    yield _create(model, args, context);
+                    // remove it from the update payload
+                    delete context.parent.create;
+                    // don't visit payload
+                    return false;
+                }),
+                createMany: (model, args, context) => __awaiter(this, void 0, void 0, function* () {
+                    // process createMany separately
+                    yield _createMany(model, args, context);
+                    // remove it from the update payload
+                    delete context.parent.createMany;
+                    // don't visit payload
+                    return false;
+                }),
+                upsert: (model, args, context) => __awaiter(this, void 0, void 0, function* () {
+                    // build a unique query including upstream conditions
+                    const uniqueFilter = yield this.utils.buildReversedQuery(context);
+                    // branch based on if the update target exists
+                    const existing = yield this.utils.checkExistence(db, model, uniqueFilter);
+                    if (existing) {
+                        // update case
+                        // check pre-update guard
+                        yield this.utils.checkPolicyForUnique(model, uniqueFilter, 'update', db, args);
+                        // register post-update check
+                        yield _registerPostUpdateCheck(model, uniqueFilter);
+                        // convert upsert to update
+                        context.parent.update = { where: args.where, data: args.update };
+                        delete context.parent.upsert;
+                        // continue visiting the new payload
+                        return context.parent.update;
+                    }
+                    else {
+                        // create case
+                        // process the entire create subtree separately
+                        yield _create(model, args.create, context);
+                        // remove it from the update payload
+                        delete context.parent.upsert;
+                        // don't visit payload
+                        return false;
+                    }
+                }),
+                connect: (model, args, context) => __awaiter(this, void 0, void 0, function* () { return _connectDisconnect(model, args, context); }),
+                connectOrCreate: (model, args, context) => __awaiter(this, void 0, void 0, function* () {
+                    // the where condition is already unique, so we can use it to check if the target exists
+                    const existing = yield this.utils.checkExistence(db, model, args.where);
+                    if (existing) {
+                        // connect
+                        yield _connectDisconnect(model, args.where, context);
+                    }
+                    else {
+                        // create
+                        yield _create(model, args.create, context);
+                    }
+                }),
+                disconnect: (model, args, context) => __awaiter(this, void 0, void 0, function* () { return _connectDisconnect(model, args, context); }),
+                set: (model, args, context) => __awaiter(this, void 0, void 0, function* () {
+                    // find the set of items to be replaced
+                    const reversedQuery = yield this.utils.buildReversedQuery(context);
+                    const findCurrSetArgs = {
+                        select: this.utils.makeIdSelection(model),
+                        where: reversedQuery,
+                    };
+                    if (this.shouldLogQuery) {
+                        this.logger.info(`[policy] \`findMany\` ${model}:\n${(0, utils_1.formatObject)(findCurrSetArgs)}`);
+                    }
+                    const currentSet = yield db[model].findMany(findCurrSetArgs);
+                    // register current set for update (foreign key)
+                    yield Promise.all(currentSet.map((item) => _connectDisconnect(model, item, context)));
+                    // proceed with connecting the new set
+                    yield Promise.all((0, utils_1.enumerate)(args).map((item) => _connectDisconnect(model, item, context)));
+                }),
+                delete: (model, args, context) => __awaiter(this, void 0, void 0, function* () {
+                    // build a unique query including upstream conditions
+                    const uniqueFilter = yield this.utils.buildReversedQuery(context);
+                    // handle not-found
+                    yield this.utils.checkExistence(db, model, uniqueFilter, true);
+                    // check delete guard
+                    yield this.utils.checkPolicyForUnique(model, uniqueFilter, 'delete', db, args);
+                }),
+                deleteMany: (model, args, context) => __awaiter(this, void 0, void 0, function* () {
+                    // inject delete guard
+                    const guard = yield this.utils.getAuthGuard(db, model, 'delete');
+                    context.parent.deleteMany = this.utils.and(args, guard);
+                }),
+            });
+            yield visitor.visit(this.model, 'update', args);
+            // finally proceed with the update
+            if (this.shouldLogQuery) {
+                this.logger.info(`[policy] \`update\` ${this.model}: ${(0, utils_1.formatObject)(args)}`);
             }
-            return this.checkReadback(origArgs, ids, 'update', 'update');
+            const result = yield db[this.model].update({
+                where: args.where,
+                data: args.data,
+                select: this.utils.makeIdSelection(this.model),
+            });
+            return { result, postWriteChecks };
         });
     }
     updateMany(args) {
@@ -179,17 +737,45 @@ class PolicyProxyHandler {
             if (!args.data) {
                 throw (0, utils_1.prismaClientValidationError)(this.prisma, 'data field is required in query argument');
             }
-            yield this.tryReject('update');
+            yield this.utils.tryReject(this.prisma, this.model, 'update');
             args = this.utils.clone(args);
-            // use a transaction to wrap the write so it can be reverted if any nested
-            // create fails access policies
-            const result = yield this.utils.processWrite(this.model, 'updateMany', args, (dbOps, writeArgs) => {
+            yield this.utils.injectAuthGuard(this.prisma, args, this.model, 'update');
+            if (this.utils.hasAuthGuard(this.model, 'postUpdate') || this.utils.getZodSchema(this.model)) {
+                // use a transaction to do post-update checks
+                const postWriteChecks = [];
+                return this.transaction((tx) => __awaiter(this, void 0, void 0, function* () {
+                    // collect pre-update values
+                    let select = this.utils.makeIdSelection(this.model);
+                    const preValueSelect = this.utils.getPreValueSelect(this.model);
+                    if (preValueSelect) {
+                        select = Object.assign(Object.assign({}, select), preValueSelect);
+                    }
+                    const currentSetQuery = { select, where: args.where };
+                    yield this.utils.injectAuthGuard(tx, currentSetQuery, this.model, 'read');
+                    if (this.shouldLogQuery) {
+                        this.logger.info(`[policy] \`findMany\` ${this.model}: ${(0, utils_1.formatObject)(currentSetQuery)}`);
+                    }
+                    const currentSet = yield tx[this.model].findMany(currentSetQuery);
+                    postWriteChecks.push(...currentSet.map((preValue) => ({
+                        model: this.model,
+                        operation: 'postUpdate',
+                        uniqueFilter: this.utils.getEntityIds(this.model, preValue),
+                        preValue: preValueSelect ? preValue : undefined,
+                    })));
+                    // proceed with the update
+                    const result = yield tx[this.model].updateMany(args);
+                    // run post-write checks
+                    yield this.runPostWriteChecks(postWriteChecks, tx);
+                    return result;
+                }));
+            }
+            else {
+                // proceed without a transaction
                 if (this.shouldLogQuery) {
-                    this.logger.info(`[withPolicy] \`updateMany\`: ${(0, utils_1.formatObject)(writeArgs)}`);
+                    this.logger.info(`[policy] \`updateMany\` ${this.model}: ${(0, utils_1.formatObject)(args)}`);
                 }
-                return dbOps.updateMany(writeArgs);
-            });
-            return result;
+                return this.modelClient.updateMany(args);
+            }
         });
     }
     upsert(args) {
@@ -206,25 +792,39 @@ class PolicyProxyHandler {
             if (!args.update) {
                 throw (0, utils_1.prismaClientValidationError)(this.prisma, 'update field is required in query argument');
             }
-            const origArgs = args;
+            yield this.utils.tryReject(this.prisma, this.model, 'create');
+            yield this.utils.tryReject(this.prisma, this.model, 'update');
             args = this.utils.clone(args);
-            yield this.tryReject('create');
-            yield this.tryReject('update');
-            // use a transaction to wrap the write so it can be reverted if any nested
-            // create fails access policies
-            const result = yield this.utils.processWrite(this.model, 'upsert', args, (dbOps, writeArgs) => {
-                if (this.shouldLogQuery) {
-                    this.logger.info(`[withPolicy] \`upsert\`: ${(0, utils_1.formatObject)(writeArgs)}`);
+            // We can call the native "upsert" because we can't tell if an entity was created or updated
+            // for doing post-write check accordingly. Instead, decompose it into create or update.
+            const { result, error } = yield this.transaction((tx) => __awaiter(this, void 0, void 0, function* () {
+                const { where, create, update } = args, rest = __rest(args, ["where", "create", "update"]);
+                const existing = yield this.utils.checkExistence(tx, this.model, args.where);
+                if (existing) {
+                    // update case
+                    const { result, postWriteChecks } = yield this.doUpdate(Object.assign({ where, data: update }, rest), tx);
+                    yield this.runPostWriteChecks(postWriteChecks, tx);
+                    return this.utils.readBack(tx, this.model, 'update', args, result);
                 }
-                return dbOps.upsert(writeArgs);
-            });
-            const ids = this.utils.getEntityIds(this.model, result);
-            if (Object.keys(ids).length === 0) {
-                throw this.utils.unknownError(`unexpected error: upsert didn't return an id`);
+                else {
+                    // create case
+                    const { result, postWriteChecks } = yield this.doCreate(this.model, Object.assign({ data: create }, rest), tx);
+                    yield this.runPostWriteChecks(postWriteChecks, tx);
+                    return this.utils.readBack(tx, this.model, 'create', args, result);
+                }
+            }));
+            if (error) {
+                throw error;
+            }
+            else {
+                return result;
             }
-            return this.checkReadback(origArgs, ids, 'upsert', 'update');
         });
     }
+    //#endregion
+    //#region Delete
+    // "delete" works against a single entity, and is rejected if the entity fails policy check.
+    // "deleteMany" works against a set of entities, entities that fail policy check are filtered out.
     delete(args) {
         return __awaiter(this, void 0, void 0, function* () {
             if (!args) {
@@ -233,55 +833,56 @@ class PolicyProxyHandler {
             if (!args.where) {
                 throw (0, utils_1.prismaClientValidationError)(this.prisma, 'where field is required in query argument');
             }
-            yield this.tryReject('delete');
-            // ensures the item under deletion passes policy check
-            yield this.utils.checkPolicyForFilter(this.model, args.where, 'delete', this.prisma);
-            // read the entity under deletion with respect to read policies
-            let readResult;
-            try {
-                const items = yield this.utils.readWithCheck(this.model, args);
-                readResult = items[0];
-            }
-            catch (err) {
-                // not readable
-                readResult = undefined;
-            }
-            // conduct the deletion
-            if (this.shouldLogQuery) {
-                this.logger.info(`[withPolicy] \`delete\`:\n${(0, utils_1.formatObject)(args)}`);
-            }
-            yield this.modelClient.delete(args);
-            if (!readResult) {
-                throw this.utils.deniedByPolicy(this.model, 'delete', 'result is not allowed to be read back', constants_1.CrudFailureReason.RESULT_NOT_READABLE);
+            yield this.utils.tryReject(this.prisma, this.model, 'delete');
+            const { result, error } = yield this.transaction((tx) => __awaiter(this, void 0, void 0, function* () {
+                // do a read-back before delete
+                const r = yield this.utils.readBack(tx, this.model, 'delete', args, args.where);
+                const error = r.error;
+                const read = r.result;
+                // check existence
+                yield this.utils.checkExistence(tx, this.model, args.where, true);
+                // inject delete guard
+                yield this.utils.checkPolicyForUnique(this.model, args.where, 'delete', tx, args);
+                // proceed with the deletion
+                if (this.shouldLogQuery) {
+                    this.logger.info(`[policy] \`delete\` ${this.model}:\n${(0, utils_1.formatObject)(args)}`);
+                }
+                yield tx[this.model].delete(args);
+                return { result: read, error };
+            }));
+            if (error) {
+                throw error;
             }
             else {
-                return readResult;
+                return result;
             }
         });
     }
     deleteMany(args) {
         return __awaiter(this, void 0, void 0, function* () {
-            yield this.tryReject('delete');
+            yield this.utils.tryReject(this.prisma, this.model, 'delete');
             // inject policy conditions
             args = args !== null && args !== void 0 ? args : {};
-            yield this.utils.injectAuthGuard(args, this.model, 'delete');
+            yield this.utils.injectAuthGuard(this.prisma, args, this.model, 'delete');
             // conduct the deletion
             if (this.shouldLogQuery) {
-                this.logger.info(`[withPolicy] \`deleteMany\`:\n${(0, utils_1.formatObject)(args)}`);
+                this.logger.info(`[policy] \`deleteMany\` ${this.model}:\n${(0, utils_1.formatObject)(args)}`);
             }
             return this.modelClient.deleteMany(args);
         });
     }
+    //#endregion
+    //#region Aggregation
     aggregate(args) {
         return __awaiter(this, void 0, void 0, function* () {
             if (!args) {
                 throw (0, utils_1.prismaClientValidationError)(this.prisma, 'query argument is required');
             }
-            yield this.tryReject('read');
+            args = this.utils.clone(args);
             // inject policy conditions
-            yield this.utils.injectAuthGuard(args, this.model, 'read');
+            yield this.utils.injectAuthGuard(this.prisma, args, this.model, 'read');
             if (this.shouldLogQuery) {
-                this.logger.info(`[withPolicy] \`aggregate\`:\n${(0, utils_1.formatObject)(args)}`);
+                this.logger.info(`[policy] \`aggregate\` ${this.model}:\n${(0, utils_1.formatObject)(args)}`);
             }
             return this.modelClient.aggregate(args);
         });
@@ -291,51 +892,88 @@ class PolicyProxyHandler {
             if (!args) {
                 throw (0, utils_1.prismaClientValidationError)(this.prisma, 'query argument is required');
             }
-            yield this.tryReject('read');
+            args = this.utils.clone(args);
             // inject policy conditions
-            yield this.utils.injectAuthGuard(args, this.model, 'read');
+            yield this.utils.injectAuthGuard(this.prisma, args, this.model, 'read');
             if (this.shouldLogQuery) {
-                this.logger.info(`[withPolicy] \`groupBy\`:\n${(0, utils_1.formatObject)(args)}`);
+                this.logger.info(`[policy] \`groupBy\` ${this.model}:\n${(0, utils_1.formatObject)(args)}`);
             }
             return this.modelClient.groupBy(args);
         });
     }
     count(args) {
         return __awaiter(this, void 0, void 0, function* () {
-            yield this.tryReject('read');
             // inject policy conditions
-            args = args !== null && args !== void 0 ? args : {};
-            yield this.utils.injectAuthGuard(args, this.model, 'read');
+            args = args ? this.utils.clone(args) : {};
+            yield this.utils.injectAuthGuard(this.prisma, args, this.model, 'read');
             if (this.shouldLogQuery) {
-                this.logger.info(`[withPolicy] \`count\`:\n${(0, utils_1.formatObject)(args)}`);
+                this.logger.info(`[policy] \`count\` ${this.model}:\n${(0, utils_1.formatObject)(args)}`);
             }
             return this.modelClient.count(args);
         });
     }
-    tryReject(operation) {
+    //#endregion
+    //#region Subscribe (Prisma Pulse)
+    subscribe(args) {
         return __awaiter(this, void 0, void 0, function* () {
-            const guard = yield this.utils.getAuthGuard(this.model, operation);
-            if (guard === false) {
-                throw this.utils.deniedByPolicy(this.model, operation);
+            const readGuard = this.utils.getAuthGuard(this.prisma, this.model, 'read');
+            if (this.utils.isTrue(readGuard)) {
+                // no need to inject
+                if (this.shouldLogQuery) {
+                    this.logger.info(`[policy] \`subscribe\` ${this.model}:\n${(0, utils_1.formatObject)(args)}`);
+                }
+                return this.modelClient.subscribe(args);
             }
-        });
-    }
-    checkReadback(origArgs, ids, action, operation) {
-        return __awaiter(this, void 0, void 0, function* () {
-            const readArgs = { select: origArgs.select, include: origArgs.include, where: ids };
-            const result = yield this.utils.readWithCheck(this.model, readArgs);
-            if (result.length === 0) {
-                this.logger.info(`${action} result cannot be read back`);
-                throw this.utils.deniedByPolicy(this.model, operation, 'result is not allowed to be read back', constants_1.CrudFailureReason.RESULT_NOT_READABLE);
+            if (!args) {
+                // include all
+                args = { create: {}, update: {}, delete: {} };
+            }
+            else {
+                if (typeof args !== 'object') {
+                    throw (0, utils_1.prismaClientValidationError)(this.prisma, 'argument must be an object');
+                }
+                if (Object.keys(args).length === 0) {
+                    // include all
+                    args = { create: {}, update: {}, delete: {} };
+                }
+                else {
+                    args = this.utils.clone(args);
+                }
+            }
+            // inject into subscribe conditions
+            if (args.create) {
+                args.create.after = this.utils.and(args.create.after, readGuard);
             }
-            else if (result.length > 1) {
-                throw this.utils.unknownError('write unexpected resulted in multiple readback entities');
+            if (args.update) {
+                args.update.after = this.utils.and(args.update.after, readGuard);
             }
-            return result[0];
+            if (args.delete) {
+                args.delete.before = this.utils.and(args.delete.before, readGuard);
+            }
+            if (this.shouldLogQuery) {
+                this.logger.info(`[policy] \`subscribe\` ${this.model}:\n${(0, utils_1.formatObject)(args)}`);
+            }
+            return this.modelClient.subscribe(args);
         });
     }
+    //#endregion
+    //#region Utils
     get shouldLogQuery() {
-        return this.logPrismaQuery && this.logger.enabled('info');
+        return !!this.logPrismaQuery && this.logger.enabled('info');
+    }
+    transaction(action) {
+        if (this.prisma[constants_1.PRISMA_TX_FLAG]) {
+            // already in transaction, don't nest
+            return action(this.prisma);
+        }
+        else {
+            return this.prisma.$transaction((tx) => action(tx));
+        }
+    }
+    runPostWriteChecks(postWriteChecks, db) {
+        return __awaiter(this, void 0, void 0, function* () {
+            yield Promise.all(postWriteChecks.map(({ model, operation, uniqueFilter, preValue }) => __awaiter(this, void 0, void 0, function* () { return this.utils.checkPolicyForUnique(model, uniqueFilter, operation, db, undefined, preValue); })));
+        });
     }
 }
 exports.PolicyProxyHandler = PolicyProxyHandler;