@zenstackhq/runtime 1.0.0-beta.20 → 1.0.0-beta.21

package/enhancements/policy/policy-utils.js

@@ -214,143 +214,133 @@ class PolicyUtil {
      * Injects model auth guard as where clause.
      */
     injectAuthGuard(db, args, model, operation) {
-        return __awaiter(this, void 0, void 0, function* () {
-            let guard = this.getAuthGuard(db, model, operation);
-            if (this.isFalse(guard)) {
+        let guard = this.getAuthGuard(db, model, operation);
+        if (this.isFalse(guard)) {
+            args.where = this.makeFalse();
+            return false;
+        }
+        if (operation === 'update' && args) {
+            // merge field-level policy guards
+            const fieldUpdateGuard = this.getFieldUpdateGuards(db, model, args);
+            if (fieldUpdateGuard.rejectedByField) {
+                // rejected
                 args.where = this.makeFalse();
                 return false;
             }
-            if (operation === 'update' && args) {
-                // merge field-level policy guards
-                const fieldUpdateGuard = this.getFieldUpdateGuards(db, model, args);
-                if (fieldUpdateGuard.rejectedByField) {
-                    // rejected
-                    args.where = this.makeFalse();
-                    return false;
-                }
-                else if (fieldUpdateGuard.guard) {
-                    // merge
-                    guard = this.and(guard, fieldUpdateGuard.guard);
-                }
-            }
-            if (args.where) {
-                // inject into relation fields:
-                //   to-many: some/none/every
-                //   to-one: direct-conditions/is/isNot
-                yield this.injectGuardForRelationFields(db, model, args.where, operation);
+            else if (fieldUpdateGuard.guard) {
+                // merge
+                guard = this.and(guard, fieldUpdateGuard.guard);
             }
-            args.where = this.and(args.where, guard);
-            return true;
-        });
+        }
+        if (args.where) {
+            // inject into relation fields:
+            //   to-many: some/none/every
+            //   to-one: direct-conditions/is/isNot
+            this.injectGuardForRelationFields(db, model, args.where, operation);
+        }
+        args.where = this.and(args.where, guard);
+        return true;
     }
     injectGuardForRelationFields(db, model, payload, operation) {
-        return __awaiter(this, void 0, void 0, function* () {
-            for (const [field, subPayload] of Object.entries(payload)) {
-                if (!subPayload) {
-                    continue;
-                }
-                const fieldInfo = yield (0, model_meta_1.resolveField)(this.modelMeta, model, field);
-                if (!fieldInfo || !fieldInfo.isDataModel) {
-                    continue;
-                }
-                if (fieldInfo.isArray) {
-                    yield this.injectGuardForToManyField(db, fieldInfo, subPayload, operation);
-                }
-                else {
-                    yield this.injectGuardForToOneField(db, fieldInfo, subPayload, operation);
-                }
+        for (const [field, subPayload] of Object.entries(payload)) {
+            if (!subPayload) {
+                continue;
             }
-        });
+            const fieldInfo = (0, model_meta_1.resolveField)(this.modelMeta, model, field);
+            if (!fieldInfo || !fieldInfo.isDataModel) {
+                continue;
+            }
+            if (fieldInfo.isArray) {
+                this.injectGuardForToManyField(db, fieldInfo, subPayload, operation);
+            }
+            else {
+                this.injectGuardForToOneField(db, fieldInfo, subPayload, operation);
+            }
+        }
     }
     injectGuardForToManyField(db, fieldInfo, payload, operation) {
-        return __awaiter(this, void 0, void 0, function* () {
-            const guard = this.getAuthGuard(db, fieldInfo.type, operation);
-            if (payload.some) {
-                yield this.injectGuardForRelationFields(db, fieldInfo.type, payload.some, operation);
-                // turn "some" into: { some: { AND: [guard, payload.some] } }
-                payload.some = this.and(payload.some, guard);
-            }
-            if (payload.none) {
-                yield this.injectGuardForRelationFields(db, fieldInfo.type, payload.none, operation);
-                // turn none into: { none: { AND: [guard, payload.none] } }
-                payload.none = this.and(payload.none, guard);
-            }
-            if (payload.every &&
-                typeof payload.every === 'object' &&
-                // ignore empty every clause
-                Object.keys(payload.every).length > 0) {
-                yield this.injectGuardForRelationFields(db, fieldInfo.type, payload.every, operation);
-                // turn "every" into: { none: { AND: [guard, { NOT: payload.every }] } }
-                if (!payload.none) {
-                    payload.none = {};
-                }
-                payload.none = this.and(payload.none, guard, this.not(payload.every));
-                delete payload.every;
-            }
-        });
+        const guard = this.getAuthGuard(db, fieldInfo.type, operation);
+        if (payload.some) {
+            this.injectGuardForRelationFields(db, fieldInfo.type, payload.some, operation);
+            // turn "some" into: { some: { AND: [guard, payload.some] } }
+            payload.some = this.and(payload.some, guard);
+        }
+        if (payload.none) {
+            this.injectGuardForRelationFields(db, fieldInfo.type, payload.none, operation);
+            // turn none into: { none: { AND: [guard, payload.none] } }
+            payload.none = this.and(payload.none, guard);
+        }
+        if (payload.every &&
+            typeof payload.every === 'object' &&
+            // ignore empty every clause
+            Object.keys(payload.every).length > 0) {
+            this.injectGuardForRelationFields(db, fieldInfo.type, payload.every, operation);
+            // turn "every" into: { none: { AND: [guard, { NOT: payload.every }] } }
+            if (!payload.none) {
+                payload.none = {};
+            }
+            payload.none = this.and(payload.none, guard, this.not(payload.every));
+            delete payload.every;
+        }
     }
     injectGuardForToOneField(db, fieldInfo, payload, operation) {
-        return __awaiter(this, void 0, void 0, function* () {
-            const guard = this.getAuthGuard(db, fieldInfo.type, operation);
-            if (payload.is || payload.isNot) {
-                if (payload.is) {
-                    yield this.injectGuardForRelationFields(db, fieldInfo.type, payload.is, operation);
-                    // turn "is" into: { is: { AND: [ originalIs, guard ] }
-                    payload.is = this.and(payload.is, guard);
-                }
-                if (payload.isNot) {
-                    yield this.injectGuardForRelationFields(db, fieldInfo.type, payload.isNot, operation);
-                    // turn "isNot" into: { isNot: { AND: [ originalIsNot, { NOT: guard } ] } }
-                    payload.isNot = this.and(payload.isNot, this.not(guard));
-                    delete payload.isNot;
-                }
+        const guard = this.getAuthGuard(db, fieldInfo.type, operation);
+        if (payload.is || payload.isNot) {
+            if (payload.is) {
+                this.injectGuardForRelationFields(db, fieldInfo.type, payload.is, operation);
+                // turn "is" into: { is: { AND: [ originalIs, guard ] }
+                payload.is = this.and(payload.is, guard);
             }
-            else {
-                yield this.injectGuardForRelationFields(db, fieldInfo.type, payload, operation);
-                // turn direct conditions into: { is: { AND: [ originalConditions, guard ] } }
-                const combined = this.and((0, deepcopy_1.default)(payload), guard);
-                Object.keys(payload).forEach((key) => delete payload[key]);
-                payload.is = combined;
+            if (payload.isNot) {
+                this.injectGuardForRelationFields(db, fieldInfo.type, payload.isNot, operation);
+                // turn "isNot" into: { isNot: { AND: [ originalIsNot, { NOT: guard } ] } }
+                payload.isNot = this.and(payload.isNot, this.not(guard));
+                delete payload.isNot;
             }
-        });
+        }
+        else {
+            this.injectGuardForRelationFields(db, fieldInfo.type, payload, operation);
+            // turn direct conditions into: { is: { AND: [ originalConditions, guard ] } }
+            const combined = this.and((0, deepcopy_1.default)(payload), guard);
+            Object.keys(payload).forEach((key) => delete payload[key]);
+            payload.is = combined;
+        }
     }
     /**
      * Injects auth guard for read operations.
      */
     injectForRead(db, model, args) {
-        return __awaiter(this, void 0, void 0, function* () {
-            const injected = {};
-            if (!(yield this.injectAuthGuard(db, injected, model, 'read'))) {
-                return false;
+        const injected = {};
+        if (!this.injectAuthGuard(db, injected, model, 'read')) {
+            return false;
+        }
+        if (args.where) {
+            // inject into relation fields:
+            //   to-many: some/none/every
+            //   to-one: direct-conditions/is/isNot
+            this.injectGuardForRelationFields(db, model, args.where, 'read');
+        }
+        if (injected.where && Object.keys(injected.where).length > 0 && !this.isTrue(injected.where)) {
+            if (!args.where) {
+                args.where = injected.where;
             }
-            if (args.where) {
-                // inject into relation fields:
-                //   to-many: some/none/every
-                //   to-one: direct-conditions/is/isNot
-                yield this.injectGuardForRelationFields(db, model, args.where, 'read');
+            else {
+                this.mergeWhereClause(args.where, injected.where);
             }
-            if (injected.where && Object.keys(injected.where).length > 0 && !this.isTrue(injected.where)) {
-                if (!args.where) {
-                    args.where = injected.where;
-                }
-                else {
-                    this.mergeWhereClause(args.where, injected.where);
-                }
+        }
+        // recursively inject read guard conditions into nested select, include, and _count
+        const hoistedConditions = this.injectNestedReadConditions(db, model, args);
+        // the injection process may generate conditions that need to be hoisted to the toplevel,
+        // if so, merge it with the existing where
+        if (hoistedConditions.length > 0) {
+            if (!args.where) {
+                args.where = this.and(...hoistedConditions);
             }
-            // recursively inject read guard conditions into nested select, include, and _count
-            const hoistedConditions = yield this.injectNestedReadConditions(db, model, args);
-            // the injection process may generate conditions that need to be hoisted to the toplevel,
-            // if so, merge it with the existing where
-            if (hoistedConditions.length > 0) {
-                if (!args.where) {
-                    args.where = this.and(...hoistedConditions);
-                }
-                else {
-                    this.mergeWhereClause(args.where, this.and(...hoistedConditions));
-                }
+            else {
+                this.mergeWhereClause(args.where, this.and(...hoistedConditions));
             }
-            return true;
-        });
+        }
+        return true;
     }
     // flatten unique constraint filters
     flattenGeneratedUniqueField(model, args) {
@@ -382,130 +372,126 @@ class PolicyUtil {
      * Builds a reversed query for the given nested path.
      */
     buildReversedQuery(context) {
-        return __awaiter(this, void 0, void 0, function* () {
-            let result, currQuery;
-            let currField;
-            for (let i = context.nestingPath.length - 1; i >= 0; i--) {
-                const { field, model, where } = context.nestingPath[i];
-                // never modify the original where because it's shared in the structure
-                const visitWhere = Object.assign({}, where);
-                if (model && where) {
-                    // make sure composite unique condition is flattened
-                    this.flattenGeneratedUniqueField(model, visitWhere);
+        let result, currQuery;
+        let currField;
+        for (let i = context.nestingPath.length - 1; i >= 0; i--) {
+            const { field, model, where } = context.nestingPath[i];
+            // never modify the original where because it's shared in the structure
+            const visitWhere = Object.assign({}, where);
+            if (model && where) {
+                // make sure composite unique condition is flattened
+                this.flattenGeneratedUniqueField(model, visitWhere);
+            }
+            if (!result) {
+                // first segment (bottom), just use its where clause
+                result = currQuery = Object.assign({}, visitWhere);
+                currField = field;
+            }
+            else {
+                if (!currField) {
+                    throw this.unknownError(`missing field in nested path`);
                 }
-                if (!result) {
-                    // first segment (bottom), just use its where clause
-                    result = currQuery = Object.assign({}, visitWhere);
-                    currField = field;
+                if (!currField.backLink) {
+                    throw this.unknownError(`field ${currField.type}.${currField.name} doesn't have a backLink`);
+                }
+                const backLinkField = this.getModelField(currField.type, currField.backLink);
+                if (backLinkField === null || backLinkField === void 0 ? void 0 : backLinkField.isArray) {
+                    // many-side of relationship, wrap with "some" query
+                    currQuery[currField.backLink] = { some: Object.assign({}, visitWhere) };
                 }
                 else {
-                    if (!currField) {
-                        throw this.unknownError(`missing field in nested path`);
-                    }
-                    if (!currField.backLink) {
-                        throw this.unknownError(`field ${currField.type}.${currField.name} doesn't have a backLink`);
-                    }
-                    const backLinkField = this.getModelField(currField.type, currField.backLink);
-                    if (backLinkField === null || backLinkField === void 0 ? void 0 : backLinkField.isArray) {
-                        // many-side of relationship, wrap with "some" query
-                        currQuery[currField.backLink] = { some: Object.assign({}, visitWhere) };
-                    }
-                    else {
-                        if (where && backLinkField.isRelationOwner && backLinkField.foreignKeyMapping) {
-                            for (const [r, fk] of Object.entries(backLinkField.foreignKeyMapping)) {
-                                currQuery[fk] = visitWhere[r];
-                            }
-                            if (i > 0) {
-                                currQuery[currField.backLink] = {};
-                            }
+                    if (where && backLinkField.isRelationOwner && backLinkField.foreignKeyMapping) {
+                        for (const [r, fk] of Object.entries(backLinkField.foreignKeyMapping)) {
+                            currQuery[fk] = visitWhere[r];
                         }
-                        else {
-                            currQuery[currField.backLink] = Object.assign({}, visitWhere);
+                        if (i > 0) {
+                            currQuery[currField.backLink] = {};
                         }
                     }
-                    currQuery = currQuery[currField.backLink];
-                    currField = field;
+                    else {
+                        currQuery[currField.backLink] = Object.assign({}, visitWhere);
+                    }
                 }
+                currQuery = currQuery[currField.backLink];
+                currField = field;
             }
-            return result;
-        });
+        }
+        return result;
     }
     injectNestedReadConditions(db, model, args) {
         var _a;
-        return __awaiter(this, void 0, void 0, function* () {
-            const injectTarget = (_a = args.select) !== null && _a !== void 0 ? _a : args.include;
-            if (!injectTarget) {
-                return [];
-            }
-            if (injectTarget._count !== undefined) {
-                // _count needs to respect read policies of related models
-                if (injectTarget._count === true) {
-                    // include count for all relations, expand to all fields
-                    // so that we can inject guard conditions for each of them
-                    injectTarget._count = { select: {} };
-                    const modelFields = (0, model_meta_1.getFields)(this.modelMeta, model);
-                    if (modelFields) {
-                        for (const [k, v] of Object.entries(modelFields)) {
-                            if (v.isDataModel && v.isArray) {
-                                // create an entry for to-many relation
-                                injectTarget._count.select[k] = {};
-                            }
+        const injectTarget = (_a = args.select) !== null && _a !== void 0 ? _a : args.include;
+        if (!injectTarget) {
+            return [];
+        }
+        if (injectTarget._count !== undefined) {
+            // _count needs to respect read policies of related models
+            if (injectTarget._count === true) {
+                // include count for all relations, expand to all fields
+                // so that we can inject guard conditions for each of them
+                injectTarget._count = { select: {} };
+                const modelFields = (0, model_meta_1.getFields)(this.modelMeta, model);
+                if (modelFields) {
+                    for (const [k, v] of Object.entries(modelFields)) {
+                        if (v.isDataModel && v.isArray) {
+                            // create an entry for to-many relation
+                            injectTarget._count.select[k] = {};
                         }
                     }
                 }
-                // inject conditions for each relation
-                for (const field of Object.keys(injectTarget._count.select)) {
-                    if (typeof injectTarget._count.select[field] !== 'object') {
-                        injectTarget._count.select[field] = {};
-                    }
-                    const fieldInfo = (0, model_meta_1.resolveField)(this.modelMeta, model, field);
-                    if (!fieldInfo) {
-                        continue;
-                    }
-                    // inject into the "where" clause inside select
-                    yield this.injectAuthGuard(db, injectTarget._count.select[field], fieldInfo.type, 'read');
-                }
             }
-            // collect filter conditions that should be hoisted to the toplevel
-            const hoistedConditions = [];
-            for (const field of (0, utils_1.getModelFields)(injectTarget)) {
+            // inject conditions for each relation
+            for (const field of Object.keys(injectTarget._count.select)) {
+                if (typeof injectTarget._count.select[field] !== 'object') {
+                    injectTarget._count.select[field] = {};
+                }
                 const fieldInfo = (0, model_meta_1.resolveField)(this.modelMeta, model, field);
-                if (!fieldInfo || !fieldInfo.isDataModel) {
-                    // only care about relation fields
+                if (!fieldInfo) {
                     continue;
                 }
-                let hoisted;
-                if (fieldInfo.isArray ||
-                    // Injecting where at include/select level for nullable to-one relation is supported since Prisma 4.8.0
-                    // https://github.com/prisma/prisma/discussions/20350
-                    fieldInfo.isOptional) {
-                    if (typeof injectTarget[field] !== 'object') {
-                        injectTarget[field] = {};
-                    }
-                    // inject extra condition for to-many or nullable to-one relation
-                    yield this.injectAuthGuard(db, injectTarget[field], fieldInfo.type, 'read');
-                    // recurse
-                    const subHoisted = yield this.injectNestedReadConditions(db, fieldInfo.type, injectTarget[field]);
-                    if (subHoisted.length > 0) {
-                        // we can convert it to a where at this level
-                        injectTarget[field].where = this.and(injectTarget[field].where, ...subHoisted);
-                    }
+                // inject into the "where" clause inside select
+                this.injectAuthGuard(db, injectTarget._count.select[field], fieldInfo.type, 'read');
+            }
+        }
+        // collect filter conditions that should be hoisted to the toplevel
+        const hoistedConditions = [];
+        for (const field of (0, utils_1.getModelFields)(injectTarget)) {
+            const fieldInfo = (0, model_meta_1.resolveField)(this.modelMeta, model, field);
+            if (!fieldInfo || !fieldInfo.isDataModel) {
+                // only care about relation fields
+                continue;
+            }
+            let hoisted;
+            if (fieldInfo.isArray ||
+                // Injecting where at include/select level for nullable to-one relation is supported since Prisma 4.8.0
+                // https://github.com/prisma/prisma/discussions/20350
+                fieldInfo.isOptional) {
+                if (typeof injectTarget[field] !== 'object') {
+                    injectTarget[field] = {};
                 }
-                else {
-                    // hoist non-nullable to-one filter to the parent level
-                    hoisted = this.getAuthGuard(db, fieldInfo.type, 'read');
-                    // recurse
-                    const subHoisted = yield this.injectNestedReadConditions(db, fieldInfo.type, injectTarget[field]);
-                    if (subHoisted.length > 0) {
-                        hoisted = this.and(hoisted, ...subHoisted);
-                    }
+                // inject extra condition for to-many or nullable to-one relation
+                this.injectAuthGuard(db, injectTarget[field], fieldInfo.type, 'read');
+                // recurse
+                const subHoisted = this.injectNestedReadConditions(db, fieldInfo.type, injectTarget[field]);
+                if (subHoisted.length > 0) {
+                    // we can convert it to a where at this level
+                    injectTarget[field].where = this.and(injectTarget[field].where, ...subHoisted);
                 }
-                if (hoisted && !this.isTrue(hoisted)) {
-                    hoistedConditions.push({ [field]: hoisted });
+            }
+            else {
+                // hoist non-nullable to-one filter to the parent level
+                hoisted = this.getAuthGuard(db, fieldInfo.type, 'read');
+                // recurse
+                const subHoisted = this.injectNestedReadConditions(db, fieldInfo.type, injectTarget[field]);
+                if (subHoisted.length > 0) {
+                    hoisted = this.and(hoisted, ...subHoisted);
                 }
             }
-            return hoistedConditions;
-        });
+            if (hoisted && !this.isTrue(hoisted)) {
+                hoistedConditions.push({ [field]: hoisted });
+            }
+        }
+        return hoistedConditions;
     }
     /**
      * Given a model and a unique filter, checks the operation is allowed by policies and field validations.
@@ -619,7 +605,7 @@ class PolicyUtil {
             this.flattenGeneratedUniqueField(model, uniqueFilter);
             const readArgs = { select: selectInclude.select, include: selectInclude.include, where: uniqueFilter };
             const error = this.deniedByPolicy(model, operation, 'result is not allowed to be read back', constants_1.CrudFailureReason.RESULT_NOT_READABLE);
-            const injectResult = yield this.injectForRead(db, model, readArgs);
+            const injectResult = this.injectForRead(db, model, readArgs);
             if (!injectResult) {
                 return { error, result: undefined };
             }
@@ -805,12 +791,6 @@ class PolicyUtil {
             if (typeof entityData !== 'object' || !entityData) {
                 return;
             }
-            // strip auxiliary fields
-            for (const auxField of constants_1.AUXILIARY_FIELDS) {
-                if (auxField in entityData) {
-                    delete entityData[auxField];
-                }
-            }
             for (const [field, fieldData] of Object.entries(entityData)) {
                 if (fieldData === undefined) {
                     continue;
@@ -859,6 +839,13 @@ class PolicyUtil {
             }
         }
     }
+    /**
+     * Gets information for all fields of a model.
+     */
+    getModelFields(model) {
+        model = (0, lower_case_first_1.lowerCaseFirst)(model);
+        return this.modelMeta.fields[model];
+    }
     /**
      * Gets information for a specific model field.
      */