@zenstackhq/runtime 1.0.0-beta.20 → 1.0.0-beta.22

package/enhancements/policy/policy-utils.js

@@ -41,13 +41,31 @@ class PolicyUtil {
      * Creates a conjunction of a list of query conditions.
      */
     and(...conditions) {
-        return this.reduce({ AND: conditions });
+        const filtered = conditions.filter((c) => c !== undefined);
+        if (filtered.length === 0) {
+            return this.makeTrue();
+        }
+        else if (filtered.length === 1) {
+            return this.reduce(filtered[0]);
+        }
+        else {
+            return this.reduce({ AND: filtered });
+        }
     }
     /**
      * Creates a disjunction of a list of query conditions.
      */
     or(...conditions) {
-        return this.reduce({ OR: conditions });
+        const filtered = conditions.filter((c) => c !== undefined);
+        if (filtered.length === 0) {
+            return this.makeFalse();
+        }
+        else if (filtered.length === 1) {
+            return this.reduce(filtered[0]);
+        }
+        else {
+            return this.reduce({ OR: filtered });
+        }
     }
     /**
      * Creates a negation of a query condition.
@@ -95,49 +113,72 @@ class PolicyUtil {
         if (condition === false) {
             return this.makeFalse();
         }
-        if ('AND' in condition && Array.isArray(condition.AND)) {
-            const children = condition.AND.map((c) => this.reduce(c)).filter((c) => c !== undefined && !this.isTrue(c));
-            if (children.length === 0) {
-                return this.makeTrue();
-            }
-            else if (children.some((c) => this.isFalse(c))) {
-                return this.makeFalse();
-            }
-            else if (children.length === 1) {
-                return children[0];
-            }
-            else {
-                return { AND: children };
-            }
+        if (condition === null) {
+            return condition;
         }
-        if ('OR' in condition && Array.isArray(condition.OR)) {
-            const children = condition.OR.map((c) => this.reduce(c)).filter((c) => c !== undefined && !this.isFalse(c));
-            if (children.length === 0) {
-                return this.makeFalse();
-            }
-            else if (children.some((c) => this.isTrue(c))) {
-                return this.makeTrue();
-            }
-            else if (children.length === 1) {
-                return children[0];
-            }
-            else {
-                return { OR: children };
-            }
-        }
-        if ('NOT' in condition && condition.NOT !== null && typeof condition.NOT === 'object') {
-            const child = this.reduce(condition.NOT);
-            if (this.isTrue(child)) {
-                return this.makeFalse();
-            }
-            else if (this.isFalse(child)) {
-                return this.makeTrue();
+        const result = {};
+        for (const [key, value] of Object.entries(condition)) {
+            if (value === null || value === undefined) {
+                result[key] = value;
+                continue;
             }
-            else {
-                return { NOT: child };
+            switch (key) {
+                case 'AND': {
+                    const children = (0, utils_1.enumerate)(value)
+                        .map((c) => this.reduce(c))
+                        .filter((c) => c !== undefined && !this.isTrue(c));
+                    if (children.length === 0) {
+                        result[key] = []; // true
+                    }
+                    else if (children.some((c) => this.isFalse(c))) {
+                        result['OR'] = []; // false
+                    }
+                    else {
+                        if (!this.isTrue({ AND: result[key] })) {
+                            // use AND only if it's not already true
+                            result[key] = !Array.isArray(value) && children.length === 1 ? children[0] : children;
+                        }
+                    }
+                    break;
+                }
+                case 'OR': {
+                    const children = (0, utils_1.enumerate)(value)
+                        .map((c) => this.reduce(c))
+                        .filter((c) => c !== undefined && !this.isFalse(c));
+                    if (children.length === 0) {
+                        result[key] = []; // false
+                    }
+                    else if (children.some((c) => this.isTrue(c))) {
+                        result['AND'] = []; // true
+                    }
+                    else {
+                        if (!this.isFalse({ OR: result[key] })) {
+                            // use OR only if it's not already false
+                            result[key] = !Array.isArray(value) && children.length === 1 ? children[0] : children;
+                        }
+                    }
+                    break;
+                }
+                case 'NOT': {
+                    result[key] = this.reduce(value);
+                    break;
+                }
+                default: {
+                    const booleanKeys = ['AND', 'OR', 'NOT', 'is', 'isNot', 'none', 'every', 'some'];
+                    if (typeof value === 'object' &&
+                        value &&
+                        // recurse only if the value has at least one boolean key
+                        Object.keys(value).some((k) => booleanKeys.includes(k))) {
+                        result[key] = this.reduce(value);
+                    }
+                    else {
+                        result[key] = value;
+                    }
+                    break;
+                }
             }
         }
-        return condition;
+        return result;
     }
     //#endregion
     //# Auth guard
@@ -214,143 +255,131 @@ class PolicyUtil {
      * Injects model auth guard as where clause.
      */
     injectAuthGuard(db, args, model, operation) {
-        return __awaiter(this, void 0, void 0, function* () {
-            let guard = this.getAuthGuard(db, model, operation);
-            if (this.isFalse(guard)) {
+        let guard = this.getAuthGuard(db, model, operation);
+        if (this.isFalse(guard)) {
+            args.where = this.makeFalse();
+            return false;
+        }
+        if (operation === 'update' && args) {
+            // merge field-level policy guards
+            const fieldUpdateGuard = this.getFieldUpdateGuards(db, model, args);
+            if (fieldUpdateGuard.rejectedByField) {
+                // rejected
                 args.where = this.makeFalse();
                 return false;
             }
-            if (operation === 'update' && args) {
-                // merge field-level policy guards
-                const fieldUpdateGuard = this.getFieldUpdateGuards(db, model, args);
-                if (fieldUpdateGuard.rejectedByField) {
-                    // rejected
-                    args.where = this.makeFalse();
-                    return false;
-                }
-                else if (fieldUpdateGuard.guard) {
-                    // merge
-                    guard = this.and(guard, fieldUpdateGuard.guard);
-                }
-            }
-            if (args.where) {
-                // inject into relation fields:
-                //   to-many: some/none/every
-                //   to-one: direct-conditions/is/isNot
-                yield this.injectGuardForRelationFields(db, model, args.where, operation);
+            else if (fieldUpdateGuard.guard) {
+                // merge
+                guard = this.and(guard, fieldUpdateGuard.guard);
             }
-            args.where = this.and(args.where, guard);
-            return true;
-        });
+        }
+        if (args.where) {
+            // inject into relation fields:
+            //   to-many: some/none/every
+            //   to-one: direct-conditions/is/isNot
+            this.injectGuardForRelationFields(db, model, args.where, operation);
+        }
+        args.where = this.and(args.where, guard);
+        return true;
     }
     injectGuardForRelationFields(db, model, payload, operation) {
-        return __awaiter(this, void 0, void 0, function* () {
-            for (const [field, subPayload] of Object.entries(payload)) {
-                if (!subPayload) {
-                    continue;
-                }
-                const fieldInfo = yield (0, model_meta_1.resolveField)(this.modelMeta, model, field);
-                if (!fieldInfo || !fieldInfo.isDataModel) {
-                    continue;
-                }
-                if (fieldInfo.isArray) {
-                    yield this.injectGuardForToManyField(db, fieldInfo, subPayload, operation);
-                }
-                else {
-                    yield this.injectGuardForToOneField(db, fieldInfo, subPayload, operation);
-                }
+        for (const [field, subPayload] of Object.entries(payload)) {
+            if (!subPayload) {
+                continue;
             }
-        });
+            const fieldInfo = (0, model_meta_1.resolveField)(this.modelMeta, model, field);
+            if (!fieldInfo || !fieldInfo.isDataModel) {
+                continue;
+            }
+            if (fieldInfo.isArray) {
+                this.injectGuardForToManyField(db, fieldInfo, subPayload, operation);
+            }
+            else {
+                this.injectGuardForToOneField(db, fieldInfo, subPayload, operation);
+            }
+        }
     }
     injectGuardForToManyField(db, fieldInfo, payload, operation) {
-        return __awaiter(this, void 0, void 0, function* () {
-            const guard = this.getAuthGuard(db, fieldInfo.type, operation);
-            if (payload.some) {
-                yield this.injectGuardForRelationFields(db, fieldInfo.type, payload.some, operation);
-                // turn "some" into: { some: { AND: [guard, payload.some] } }
-                payload.some = this.and(payload.some, guard);
-            }
-            if (payload.none) {
-                yield this.injectGuardForRelationFields(db, fieldInfo.type, payload.none, operation);
-                // turn none into: { none: { AND: [guard, payload.none] } }
-                payload.none = this.and(payload.none, guard);
-            }
-            if (payload.every &&
-                typeof payload.every === 'object' &&
-                // ignore empty every clause
-                Object.keys(payload.every).length > 0) {
-                yield this.injectGuardForRelationFields(db, fieldInfo.type, payload.every, operation);
-                // turn "every" into: { none: { AND: [guard, { NOT: payload.every }] } }
-                if (!payload.none) {
-                    payload.none = {};
-                }
-                payload.none = this.and(payload.none, guard, this.not(payload.every));
-                delete payload.every;
-            }
-        });
+        const guard = this.getAuthGuard(db, fieldInfo.type, operation);
+        if (payload.some) {
+            this.injectGuardForRelationFields(db, fieldInfo.type, payload.some, operation);
+            // turn "some" into: { some: { AND: [guard, payload.some] } }
+            payload.some = this.and(payload.some, guard);
+        }
+        if (payload.none) {
+            this.injectGuardForRelationFields(db, fieldInfo.type, payload.none, operation);
+            // turn none into: { none: { AND: [guard, payload.none] } }
+            payload.none = this.and(payload.none, guard);
+        }
+        if (payload.every &&
+            typeof payload.every === 'object' &&
+            // ignore empty every clause
+            Object.keys(payload.every).length > 0) {
+            this.injectGuardForRelationFields(db, fieldInfo.type, payload.every, operation);
+            // turn "every" into: { none: { AND: [guard, { NOT: payload.every }] } }
+            if (!payload.none) {
+                payload.none = {};
+            }
+            payload.none = this.and(payload.none, guard, this.not(payload.every));
+            delete payload.every;
+        }
     }
     injectGuardForToOneField(db, fieldInfo, payload, operation) {
-        return __awaiter(this, void 0, void 0, function* () {
-            const guard = this.getAuthGuard(db, fieldInfo.type, operation);
-            if (payload.is || payload.isNot) {
-                if (payload.is) {
-                    yield this.injectGuardForRelationFields(db, fieldInfo.type, payload.is, operation);
-                    // turn "is" into: { is: { AND: [ originalIs, guard ] }
-                    payload.is = this.and(payload.is, guard);
-                }
-                if (payload.isNot) {
-                    yield this.injectGuardForRelationFields(db, fieldInfo.type, payload.isNot, operation);
-                    // turn "isNot" into: { isNot: { AND: [ originalIsNot, { NOT: guard } ] } }
-                    payload.isNot = this.and(payload.isNot, this.not(guard));
-                    delete payload.isNot;
-                }
+        const guard = this.getAuthGuard(db, fieldInfo.type, operation);
+        // is|isNot and flat fields conditions are mutually exclusive
+        if (payload.is || payload.isNot) {
+            if (payload.is) {
+                this.injectGuardForRelationFields(db, fieldInfo.type, payload.is, operation);
             }
-            else {
-                yield this.injectGuardForRelationFields(db, fieldInfo.type, payload, operation);
-                // turn direct conditions into: { is: { AND: [ originalConditions, guard ] } }
-                const combined = this.and((0, deepcopy_1.default)(payload), guard);
-                Object.keys(payload).forEach((key) => delete payload[key]);
-                payload.is = combined;
+            if (payload.isNot) {
+                this.injectGuardForRelationFields(db, fieldInfo.type, payload.isNot, operation);
             }
-        });
+            // merge guard with existing "is": { is: [originalIs, guard] }
+            payload.is = this.and(payload.is, guard);
+        }
+        else {
+            this.injectGuardForRelationFields(db, fieldInfo.type, payload, operation);
+            // turn direct conditions into: { is: { AND: [ originalConditions, guard ] } }
+            const combined = this.and((0, deepcopy_1.default)(payload), guard);
+            Object.keys(payload).forEach((key) => delete payload[key]);
+            payload.is = combined;
+        }
     }
     /**
      * Injects auth guard for read operations.
      */
     injectForRead(db, model, args) {
-        return __awaiter(this, void 0, void 0, function* () {
-            const injected = {};
-            if (!(yield this.injectAuthGuard(db, injected, model, 'read'))) {
-                return false;
+        const injected = {};
+        if (!this.injectAuthGuard(db, injected, model, 'read')) {
+            return false;
+        }
+        if (args.where) {
+            // inject into relation fields:
+            //   to-many: some/none/every
+            //   to-one: direct-conditions/is/isNot
+            this.injectGuardForRelationFields(db, model, args.where, 'read');
+        }
+        if (injected.where && Object.keys(injected.where).length > 0 && !this.isTrue(injected.where)) {
+            if (!args.where) {
+                args.where = injected.where;
             }
-            if (args.where) {
-                // inject into relation fields:
-                //   to-many: some/none/every
-                //   to-one: direct-conditions/is/isNot
-                yield this.injectGuardForRelationFields(db, model, args.where, 'read');
+            else {
+                this.mergeWhereClause(args.where, injected.where);
             }
-            if (injected.where && Object.keys(injected.where).length > 0 && !this.isTrue(injected.where)) {
-                if (!args.where) {
-                    args.where = injected.where;
-                }
-                else {
-                    this.mergeWhereClause(args.where, injected.where);
-                }
+        }
+        // recursively inject read guard conditions into nested select, include, and _count
+        const hoistedConditions = this.injectNestedReadConditions(db, model, args);
+        // the injection process may generate conditions that need to be hoisted to the toplevel,
+        // if so, merge it with the existing where
+        if (hoistedConditions.length > 0) {
+            if (!args.where) {
+                args.where = this.and(...hoistedConditions);
             }
-            // recursively inject read guard conditions into nested select, include, and _count
-            const hoistedConditions = yield this.injectNestedReadConditions(db, model, args);
-            // the injection process may generate conditions that need to be hoisted to the toplevel,
-            // if so, merge it with the existing where
-            if (hoistedConditions.length > 0) {
-                if (!args.where) {
-                    args.where = this.and(...hoistedConditions);
-                }
-                else {
-                    this.mergeWhereClause(args.where, this.and(...hoistedConditions));
-                }
+            else {
+                this.mergeWhereClause(args.where, this.and(...hoistedConditions));
             }
-            return true;
-        });
+        }
+        return true;
     }
     // flatten unique constraint filters
     flattenGeneratedUniqueField(model, args) {
@@ -382,130 +411,126 @@ class PolicyUtil {
      * Builds a reversed query for the given nested path.
      */
     buildReversedQuery(context) {
-        return __awaiter(this, void 0, void 0, function* () {
-            let result, currQuery;
-            let currField;
-            for (let i = context.nestingPath.length - 1; i >= 0; i--) {
-                const { field, model, where } = context.nestingPath[i];
-                // never modify the original where because it's shared in the structure
-                const visitWhere = Object.assign({}, where);
-                if (model && where) {
-                    // make sure composite unique condition is flattened
-                    this.flattenGeneratedUniqueField(model, visitWhere);
+        let result, currQuery;
+        let currField;
+        for (let i = context.nestingPath.length - 1; i >= 0; i--) {
+            const { field, model, where } = context.nestingPath[i];
+            // never modify the original where because it's shared in the structure
+            const visitWhere = Object.assign({}, where);
+            if (model && where) {
+                // make sure composite unique condition is flattened
+                this.flattenGeneratedUniqueField(model, visitWhere);
+            }
+            if (!result) {
+                // first segment (bottom), just use its where clause
+                result = currQuery = Object.assign({}, visitWhere);
+                currField = field;
+            }
+            else {
+                if (!currField) {
+                    throw this.unknownError(`missing field in nested path`);
                 }
-                if (!result) {
-                    // first segment (bottom), just use its where clause
-                    result = currQuery = Object.assign({}, visitWhere);
-                    currField = field;
+                if (!currField.backLink) {
+                    throw this.unknownError(`field ${currField.type}.${currField.name} doesn't have a backLink`);
+                }
+                const backLinkField = this.getModelField(currField.type, currField.backLink);
+                if (backLinkField === null || backLinkField === void 0 ? void 0 : backLinkField.isArray) {
+                    // many-side of relationship, wrap with "some" query
+                    currQuery[currField.backLink] = { some: Object.assign({}, visitWhere) };
                 }
                 else {
-                    if (!currField) {
-                        throw this.unknownError(`missing field in nested path`);
-                    }
-                    if (!currField.backLink) {
-                        throw this.unknownError(`field ${currField.type}.${currField.name} doesn't have a backLink`);
-                    }
-                    const backLinkField = this.getModelField(currField.type, currField.backLink);
-                    if (backLinkField === null || backLinkField === void 0 ? void 0 : backLinkField.isArray) {
-                        // many-side of relationship, wrap with "some" query
-                        currQuery[currField.backLink] = { some: Object.assign({}, visitWhere) };
-                    }
-                    else {
-                        if (where && backLinkField.isRelationOwner && backLinkField.foreignKeyMapping) {
-                            for (const [r, fk] of Object.entries(backLinkField.foreignKeyMapping)) {
-                                currQuery[fk] = visitWhere[r];
-                            }
-                            if (i > 0) {
-                                currQuery[currField.backLink] = {};
-                            }
+                    if (where && backLinkField.isRelationOwner && backLinkField.foreignKeyMapping) {
+                        for (const [r, fk] of Object.entries(backLinkField.foreignKeyMapping)) {
+                            currQuery[fk] = visitWhere[r];
                         }
-                        else {
-                            currQuery[currField.backLink] = Object.assign({}, visitWhere);
+                        if (i > 0) {
+                            currQuery[currField.backLink] = {};
                         }
                     }
-                    currQuery = currQuery[currField.backLink];
-                    currField = field;
+                    else {
+                        currQuery[currField.backLink] = Object.assign({}, visitWhere);
+                    }
                 }
+                currQuery = currQuery[currField.backLink];
+                currField = field;
             }
-            return result;
-        });
+        }
+        return result;
     }
     injectNestedReadConditions(db, model, args) {
         var _a;
-        return __awaiter(this, void 0, void 0, function* () {
-            const injectTarget = (_a = args.select) !== null && _a !== void 0 ? _a : args.include;
-            if (!injectTarget) {
-                return [];
-            }
-            if (injectTarget._count !== undefined) {
-                // _count needs to respect read policies of related models
-                if (injectTarget._count === true) {
-                    // include count for all relations, expand to all fields
-                    // so that we can inject guard conditions for each of them
-                    injectTarget._count = { select: {} };
-                    const modelFields = (0, model_meta_1.getFields)(this.modelMeta, model);
-                    if (modelFields) {
-                        for (const [k, v] of Object.entries(modelFields)) {
-                            if (v.isDataModel && v.isArray) {
-                                // create an entry for to-many relation
-                                injectTarget._count.select[k] = {};
-                            }
+        const injectTarget = (_a = args.select) !== null && _a !== void 0 ? _a : args.include;
+        if (!injectTarget) {
+            return [];
+        }
+        if (injectTarget._count !== undefined) {
+            // _count needs to respect read policies of related models
+            if (injectTarget._count === true) {
+                // include count for all relations, expand to all fields
+                // so that we can inject guard conditions for each of them
+                injectTarget._count = { select: {} };
+                const modelFields = (0, model_meta_1.getFields)(this.modelMeta, model);
+                if (modelFields) {
+                    for (const [k, v] of Object.entries(modelFields)) {
+                        if (v.isDataModel && v.isArray) {
+                            // create an entry for to-many relation
+                            injectTarget._count.select[k] = {};
                         }
                     }
                 }
-                // inject conditions for each relation
-                for (const field of Object.keys(injectTarget._count.select)) {
-                    if (typeof injectTarget._count.select[field] !== 'object') {
-                        injectTarget._count.select[field] = {};
-                    }
-                    const fieldInfo = (0, model_meta_1.resolveField)(this.modelMeta, model, field);
-                    if (!fieldInfo) {
-                        continue;
-                    }
-                    // inject into the "where" clause inside select
-                    yield this.injectAuthGuard(db, injectTarget._count.select[field], fieldInfo.type, 'read');
-                }
             }
-            // collect filter conditions that should be hoisted to the toplevel
-            const hoistedConditions = [];
-            for (const field of (0, utils_1.getModelFields)(injectTarget)) {
+            // inject conditions for each relation
+            for (const field of Object.keys(injectTarget._count.select)) {
+                if (typeof injectTarget._count.select[field] !== 'object') {
+                    injectTarget._count.select[field] = {};
+                }
                 const fieldInfo = (0, model_meta_1.resolveField)(this.modelMeta, model, field);
-                if (!fieldInfo || !fieldInfo.isDataModel) {
-                    // only care about relation fields
+                if (!fieldInfo) {
                     continue;
                 }
-                let hoisted;
-                if (fieldInfo.isArray ||
-                    // Injecting where at include/select level for nullable to-one relation is supported since Prisma 4.8.0
-                    // https://github.com/prisma/prisma/discussions/20350
-                    fieldInfo.isOptional) {
-                    if (typeof injectTarget[field] !== 'object') {
-                        injectTarget[field] = {};
-                    }
-                    // inject extra condition for to-many or nullable to-one relation
-                    yield this.injectAuthGuard(db, injectTarget[field], fieldInfo.type, 'read');
-                    // recurse
-                    const subHoisted = yield this.injectNestedReadConditions(db, fieldInfo.type, injectTarget[field]);
-                    if (subHoisted.length > 0) {
-                        // we can convert it to a where at this level
-                        injectTarget[field].where = this.and(injectTarget[field].where, ...subHoisted);
-                    }
+                // inject into the "where" clause inside select
+                this.injectAuthGuard(db, injectTarget._count.select[field], fieldInfo.type, 'read');
+            }
+        }
+        // collect filter conditions that should be hoisted to the toplevel
+        const hoistedConditions = [];
+        for (const field of (0, utils_1.getModelFields)(injectTarget)) {
+            const fieldInfo = (0, model_meta_1.resolveField)(this.modelMeta, model, field);
+            if (!fieldInfo || !fieldInfo.isDataModel) {
+                // only care about relation fields
+                continue;
+            }
+            let hoisted;
+            if (fieldInfo.isArray ||
+                // Injecting where at include/select level for nullable to-one relation is supported since Prisma 4.8.0
+                // https://github.com/prisma/prisma/discussions/20350
+                fieldInfo.isOptional) {
+                if (typeof injectTarget[field] !== 'object') {
+                    injectTarget[field] = {};
                 }
-                else {
-                    // hoist non-nullable to-one filter to the parent level
-                    hoisted = this.getAuthGuard(db, fieldInfo.type, 'read');
-                    // recurse
-                    const subHoisted = yield this.injectNestedReadConditions(db, fieldInfo.type, injectTarget[field]);
-                    if (subHoisted.length > 0) {
-                        hoisted = this.and(hoisted, ...subHoisted);
-                    }
+                // inject extra condition for to-many or nullable to-one relation
+                this.injectAuthGuard(db, injectTarget[field], fieldInfo.type, 'read');
+                // recurse
+                const subHoisted = this.injectNestedReadConditions(db, fieldInfo.type, injectTarget[field]);
+                if (subHoisted.length > 0) {
+                    // we can convert it to a where at this level
+                    injectTarget[field].where = this.and(injectTarget[field].where, ...subHoisted);
                 }
-                if (hoisted && !this.isTrue(hoisted)) {
-                    hoistedConditions.push({ [field]: hoisted });
+            }
+            else {
+                // hoist non-nullable to-one filter to the parent level
+                hoisted = this.getAuthGuard(db, fieldInfo.type, 'read');
+                // recurse
+                const subHoisted = this.injectNestedReadConditions(db, fieldInfo.type, injectTarget[field]);
+                if (subHoisted.length > 0) {
+                    hoisted = this.and(hoisted, ...subHoisted);
                 }
             }
-            return hoistedConditions;
-        });
+            if (hoisted && !this.isTrue(hoisted)) {
+                hoistedConditions.push({ [field]: hoisted });
+            }
+        }
+        return hoistedConditions;
     }
     /**
      * Given a model and a unique filter, checks the operation is allowed by policies and field validations.
@@ -515,14 +540,14 @@ class PolicyUtil {
         return __awaiter(this, void 0, void 0, function* () {
             let guard = this.getAuthGuard(db, model, operation, preValue);
             if (this.isFalse(guard)) {
-                throw this.deniedByPolicy(model, operation, `entity ${(0, utils_1.formatObject)(uniqueFilter)} failed policy check`);
+                throw this.deniedByPolicy(model, operation, `entity ${(0, utils_1.formatObject)(uniqueFilter)} failed policy check`, constants_1.CrudFailureReason.ACCESS_POLICY_VIOLATION);
             }
             if (operation === 'update' && args) {
                 // merge field-level policy guards
                 const fieldUpdateGuard = this.getFieldUpdateGuards(db, model, args);
                 if (fieldUpdateGuard.rejectedByField) {
                     // rejected
-                    throw this.deniedByPolicy(model, 'update', `entity ${(0, utils_1.formatObject)(uniqueFilter)} failed update policy check for field "${fieldUpdateGuard.rejectedByField}"`);
+                    throw this.deniedByPolicy(model, 'update', `entity ${(0, utils_1.formatObject)(uniqueFilter)} failed update policy check for field "${fieldUpdateGuard.rejectedByField}"`, constants_1.CrudFailureReason.ACCESS_POLICY_VIOLATION);
                 }
                 else if (fieldUpdateGuard.guard) {
                     // merge
@@ -551,7 +576,7 @@ class PolicyUtil {
             }
             const result = yield db[model].findFirst(query);
             if (!result) {
-                throw this.deniedByPolicy(model, operation, `entity ${(0, utils_1.formatObject)(uniqueFilter)} failed policy check`);
+                throw this.deniedByPolicy(model, operation, `entity ${(0, utils_1.formatObject)(uniqueFilter)} failed policy check`, constants_1.CrudFailureReason.ACCESS_POLICY_VIOLATION);
             }
             if (schema) {
                 // TODO: push down schema check to the database
@@ -561,7 +586,7 @@ class PolicyUtil {
                     if (this.logger.enabled('info')) {
                         this.logger.info(`entity ${model} failed validation for operation ${operation}: ${error}`);
                     }
-                    throw this.deniedByPolicy(model, operation, `entities ${JSON.stringify(uniqueFilter)} failed validation: [${error}]`, constants_1.CrudFailureReason.DATA_VALIDATION_VIOLATION);
+                    throw this.deniedByPolicy(model, operation, `entities ${JSON.stringify(uniqueFilter)} failed validation: [${error}]`, constants_1.CrudFailureReason.DATA_VALIDATION_VIOLATION, parseResult.error);
                 }
             }
         });
@@ -587,7 +612,7 @@ class PolicyUtil {
     tryReject(db, model, operation) {
         const guard = this.getAuthGuard(db, model, operation);
         if (this.isFalse(guard)) {
-            throw this.deniedByPolicy(model, operation);
+            throw this.deniedByPolicy(model, operation, undefined, constants_1.CrudFailureReason.ACCESS_POLICY_VIOLATION);
         }
     }
     /**
@@ -619,7 +644,7 @@ class PolicyUtil {
             this.flattenGeneratedUniqueField(model, uniqueFilter);
             const readArgs = { select: selectInclude.select, include: selectInclude.include, where: uniqueFilter };
             const error = this.deniedByPolicy(model, operation, 'result is not allowed to be read back', constants_1.CrudFailureReason.RESULT_NOT_READABLE);
-            const injectResult = yield this.injectForRead(db, model, readArgs);
+            const injectResult = this.injectForRead(db, model, readArgs);
             if (!injectResult) {
                 return { error, result: undefined };
             }
@@ -712,8 +737,15 @@ class PolicyUtil {
     }
     //#endregion
     //#region Errors
-    deniedByPolicy(model, operation, extra, reason) {
-        return (0, utils_1.prismaClientKnownRequestError)(this.db, `denied by policy: ${model} entities failed '${operation}' check${extra ? ', ' + extra : ''}`, { clientVersion: (0, version_1.getVersion)(), code: constants_1.PrismaErrorCode.CONSTRAINED_FAILED, meta: { reason } });
+    deniedByPolicy(model, operation, extra, reason, zodErrors) {
+        const args = { clientVersion: (0, version_1.getVersion)(), code: constants_1.PrismaErrorCode.CONSTRAINED_FAILED, meta: {} };
+        if (reason) {
+            args.meta.reason = reason;
+        }
+        if (zodErrors) {
+            args.meta.zodErrors = zodErrors;
+        }
+        return (0, utils_1.prismaClientKnownRequestError)(this.db, `denied by policy: ${model} entities failed '${operation}' check${extra ? ', ' + extra : ''}`, args);
     }
     notFound(model) {
         return (0, utils_1.prismaClientKnownRequestError)(this.db, `entity not found for model ${model}`, {
@@ -722,9 +754,7 @@ class PolicyUtil {
         });
     }
     validationError(message) {
-        return (0, utils_1.prismaClientValidationError)(this.db, message, {
-            clientVersion: (0, version_1.getVersion)(),
-        });
+        return (0, utils_1.prismaClientValidationError)(this.db, message);
     }
     unknownError(message) {
         return (0, utils_1.prismaClientUnknownRequestError)(this.db, message, {
@@ -805,12 +835,6 @@ class PolicyUtil {
             if (typeof entityData !== 'object' || !entityData) {
                 return;
             }
-            // strip auxiliary fields
-            for (const auxField of constants_1.AUXILIARY_FIELDS) {
-                if (auxField in entityData) {
-                    delete entityData[auxField];
-                }
-            }
             for (const [field, fieldData] of Object.entries(entityData)) {
                 if (fieldData === undefined) {
                     continue;
@@ -859,6 +883,13 @@ class PolicyUtil {
             }
         }
     }
+    /**
+     * Gets information for all fields of a model.
+     */
+    getModelFields(model) {
+        model = (0, lower_case_first_1.lowerCaseFirst)(model);
+        return this.modelMeta.fields[model];
+    }
     /**
      * Gets information for a specific model field.
      */
@@ -902,7 +933,6 @@ class PolicyUtil {
         if (!where) {
             throw new Error('invalid where clause');
         }
-        extra = this.reduce(extra);
         if (this.isTrue(extra)) {
             return;
         }