@zenstackhq/runtime 1.0.0-beta.9 → 1.0.0

package/enhancements/policy/policy-utils.js

@@ -14,704 +14,755 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.PolicyUtil = void 0;
-const cuid2_1 = require("@paralleldrive/cuid2");
 const deepcopy_1 = __importDefault(require("deepcopy"));
 const lower_case_first_1 = require("lower-case-first");
-const pluralize_1 = __importDefault(require("pluralize"));
 const upper_case_first_1 = require("upper-case-first");
 const zod_validation_error_1 = require("zod-validation-error");
 const constants_1 = require("../../constants");
-const error_1 = require("../../error");
 const version_1 = require("../../version");
 const model_meta_1 = require("../model-meta");
-const nested_write_vistor_1 = require("../nested-write-vistor");
 const utils_1 = require("../utils");
 const logger_1 = require("./logger");
 /**
  * Access policy enforcement utilities
  */
 class PolicyUtil {
-    constructor(db, modelMeta, policy, zodSchemas, user, logPrismaQuery) {
+    constructor(db, modelMeta, policy, zodSchemas, user, shouldLogQuery = false) {
         this.db = db;
         this.modelMeta = modelMeta;
         this.policy = policy;
         this.zodSchemas = zodSchemas;
         this.user = user;
-        this.logPrismaQuery = logPrismaQuery;
+        this.shouldLogQuery = shouldLogQuery;
         this.logger = new logger_1.Logger(db);
     }
+    //#region Logical operators
     /**
      * Creates a conjunction of a list of query conditions.
      */
     and(...conditions) {
-        if (conditions.includes(false)) {
-            // always false
-            return { [constants_1.GUARD_FIELD_NAME]: false };
-        }
-        const filtered = conditions.filter((c) => typeof c === 'object' && !!c && Object.keys(c).length > 0);
+        const filtered = conditions.filter((c) => c !== undefined);
         if (filtered.length === 0) {
-            return undefined;
+            return this.makeTrue();
         }
         else if (filtered.length === 1) {
-            return filtered[0];
+            return this.reduce(filtered[0]);
         }
         else {
-            return { AND: filtered };
+            return this.reduce({ AND: filtered });
         }
     }
     /**
      * Creates a disjunction of a list of query conditions.
      */
     or(...conditions) {
-        if (conditions.includes(true)) {
-            // always true
-            return { [constants_1.GUARD_FIELD_NAME]: true };
-        }
-        const filtered = conditions.filter((c) => typeof c === 'object' && !!c);
+        const filtered = conditions.filter((c) => c !== undefined);
         if (filtered.length === 0) {
-            return undefined;
+            return this.makeFalse();
         }
         else if (filtered.length === 1) {
-            return filtered[0];
+            return this.reduce(filtered[0]);
         }
         else {
-            return { OR: filtered };
+            return this.reduce({ OR: filtered });
         }
     }
     /**
      * Creates a negation of a query condition.
      */
     not(condition) {
-        if (typeof condition === 'boolean') {
-            return !condition;
+        if (condition === undefined) {
+            return this.makeTrue();
+        }
+        else if (typeof condition === 'boolean') {
+            return this.reduce(!condition);
+        }
+        else {
+            return this.reduce({ NOT: condition });
+        }
+    }
+    // Static True/False conditions
+    // https://www.prisma.io/docs/concepts/components/prisma-client/null-and-undefined#the-effect-of-null-and-undefined-on-conditionals
+    isTrue(condition) {
+        if (condition === null || condition === undefined) {
+            return false;
+        }
+        else {
+            return ((typeof condition === 'object' && Object.keys(condition).length === 0) ||
+                ('AND' in condition && Array.isArray(condition.AND) && condition.AND.length === 0));
+        }
+    }
+    isFalse(condition) {
+        if (condition === null || condition === undefined) {
+            return false;
         }
         else {
-            return { NOT: condition };
+            return 'OR' in condition && Array.isArray(condition.OR) && condition.OR.length === 0;
+        }
+    }
+    makeTrue() {
+        return { AND: [] };
+    }
+    makeFalse() {
+        return { OR: [] };
+    }
+    reduce(condition) {
+        if (condition === true || condition === undefined) {
+            return this.makeTrue();
+        }
+        if (condition === false) {
+            return this.makeFalse();
+        }
+        if (condition === null) {
+            return condition;
+        }
+        const result = {};
+        for (const [key, value] of Object.entries(condition)) {
+            if (value === null || value === undefined) {
+                result[key] = value;
+                continue;
+            }
+            switch (key) {
+                case 'AND': {
+                    const children = (0, utils_1.enumerate)(value)
+                        .map((c) => this.reduce(c))
+                        .filter((c) => c !== undefined && !this.isTrue(c));
+                    if (children.length === 0) {
+                        result[key] = []; // true
+                    }
+                    else if (children.some((c) => this.isFalse(c))) {
+                        result['OR'] = []; // false
+                    }
+                    else {
+                        if (!this.isTrue({ AND: result[key] })) {
+                            // use AND only if it's not already true
+                            result[key] = !Array.isArray(value) && children.length === 1 ? children[0] : children;
+                        }
+                    }
+                    break;
+                }
+                case 'OR': {
+                    const children = (0, utils_1.enumerate)(value)
+                        .map((c) => this.reduce(c))
+                        .filter((c) => c !== undefined && !this.isFalse(c));
+                    if (children.length === 0) {
+                        result[key] = []; // false
+                    }
+                    else if (children.some((c) => this.isTrue(c))) {
+                        result['AND'] = []; // true
+                    }
+                    else {
+                        if (!this.isFalse({ OR: result[key] })) {
+                            // use OR only if it's not already false
+                            result[key] = !Array.isArray(value) && children.length === 1 ? children[0] : children;
+                        }
+                    }
+                    break;
+                }
+                case 'NOT': {
+                    result[key] = this.reduce(value);
+                    break;
+                }
+                default: {
+                    const booleanKeys = ['AND', 'OR', 'NOT', 'is', 'isNot', 'none', 'every', 'some'];
+                    if (typeof value === 'object' &&
+                        value &&
+                        // recurse only if the value has at least one boolean key
+                        Object.keys(value).some((k) => booleanKeys.includes(k))) {
+                        result[key] = this.reduce(value);
+                    }
+                    else {
+                        result[key] = value;
+                    }
+                    break;
+                }
+            }
         }
+        return result;
     }
+    //#endregion
+    //# Auth guard
     /**
      * Gets pregenerated authorization guard object for a given model and operation.
      *
      * @returns true if operation is unconditionally allowed, false if unconditionally denied,
      * otherwise returns a guard object
      */
-    getAuthGuard(model, operation, preValue) {
+    getAuthGuard(db, model, operation, preValue) {
         const guard = this.policy.guard[(0, lower_case_first_1.lowerCaseFirst)(model)];
         if (!guard) {
             throw this.unknownError(`unable to load policy guard for ${model}`);
         }
         const provider = guard[operation];
         if (typeof provider === 'boolean') {
-            return provider;
+            return this.reduce(provider);
         }
         if (!provider) {
             throw this.unknownError(`zenstack: unable to load authorization guard for ${model}`);
         }
-        return provider({ user: this.user, preValue });
+        const r = provider({ user: this.user, preValue }, db);
+        return this.reduce(r);
     }
-    hasValidation(model) {
-        var _a, _b;
-        return ((_b = (_a = this.policy.validation) === null || _a === void 0 ? void 0 : _a[(0, lower_case_first_1.lowerCaseFirst)(model)]) === null || _b === void 0 ? void 0 : _b.hasValidation) === true;
+    /**
+     * Get field-level auth guard
+     */
+    getFieldUpdateAuthGuard(db, model, field) {
+        const guard = this.policy.guard[(0, lower_case_first_1.lowerCaseFirst)(model)];
+        if (!guard) {
+            throw this.unknownError(`unable to load policy guard for ${model}`);
+        }
+        const provider = guard[`${constants_1.FIELD_LEVEL_UPDATE_GUARD_PREFIX}${field}`];
+        if (typeof provider === 'boolean') {
+            return this.reduce(provider);
+        }
+        if (!provider) {
+            return this.makeTrue();
+        }
+        const r = provider({ user: this.user }, db);
+        return this.reduce(r);
     }
-    getPreValueSelect(model) {
-        return __awaiter(this, void 0, void 0, function* () {
-            const guard = this.policy.guard[(0, lower_case_first_1.lowerCaseFirst)(model)];
-            if (!guard) {
-                throw this.unknownError(`unable to load policy guard for ${model}`);
-            }
-            return guard.preValueSelect;
-        });
+    /**
+     * Checks if the given model has a policy guard for the given operation.
+     */
+    hasAuthGuard(model, operation) {
+        const guard = this.policy.guard[(0, lower_case_first_1.lowerCaseFirst)(model)];
+        if (!guard) {
+            return false;
+        }
+        const provider = guard[operation];
+        return typeof provider !== 'boolean' || provider !== true;
     }
-    getModelSchema(model) {
-        var _a, _b;
-        return this.hasValidation(model) && ((_b = (_a = this.zodSchemas) === null || _a === void 0 ? void 0 : _a.models) === null || _b === void 0 ? void 0 : _b[`${(0, upper_case_first_1.upperCaseFirst)(model)}Schema`]);
+    /**
+     * Checks model creation policy based on static analysis to the input args.
+     *
+     * @returns boolean if static analysis is enough to determine the result, undefined if not
+     */
+    checkInputGuard(model, args, operation) {
+        const guard = this.policy.guard[(0, lower_case_first_1.lowerCaseFirst)(model)];
+        if (!guard) {
+            return undefined;
+        }
+        const provider = guard[`${operation}_input`];
+        if (typeof provider === 'boolean') {
+            return provider;
+        }
+        if (!provider) {
+            return undefined;
+        }
+        return provider(args, { user: this.user });
     }
     /**
      * Injects model auth guard as where clause.
      */
-    injectAuthGuard(args, model, operation) {
-        return __awaiter(this, void 0, void 0, function* () {
-            if (args.where) {
-                // inject into relation fields:
-                //   to-many: some/none/every
-                //   to-one: direct-conditions/is/isNot
-                yield this.injectGuardForFields(model, args.where, operation);
-            }
-            const guard = this.getAuthGuard(model, operation);
-            args.where = this.and(args.where, guard);
-        });
+    injectAuthGuard(db, args, model, operation) {
+        let guard = this.getAuthGuard(db, model, operation);
+        if (this.isFalse(guard)) {
+            args.where = this.makeFalse();
+            return false;
+        }
+        if (operation === 'update' && args) {
+            // merge field-level policy guards
+            const fieldUpdateGuard = this.getFieldUpdateGuards(db, model, args);
+            if (fieldUpdateGuard.rejectedByField) {
+                // rejected
+                args.where = this.makeFalse();
+                return false;
+            }
+            else if (fieldUpdateGuard.guard) {
+                // merge
+                guard = this.and(guard, fieldUpdateGuard.guard);
+            }
+        }
+        if (args.where) {
+            // inject into relation fields:
+            //   to-many: some/none/every
+            //   to-one: direct-conditions/is/isNot
+            this.injectGuardForRelationFields(db, model, args.where, operation);
+        }
+        args.where = this.and(args.where, guard);
+        return true;
     }
-    injectGuardForFields(model, payload, operation) {
-        return __awaiter(this, void 0, void 0, function* () {
-            for (const [field, subPayload] of Object.entries(payload)) {
-                if (!subPayload) {
-                    continue;
-                }
-                const fieldInfo = yield (0, model_meta_1.resolveField)(this.modelMeta, model, field);
-                if (!fieldInfo || !fieldInfo.isDataModel) {
-                    continue;
-                }
-                if (fieldInfo.isArray) {
-                    yield this.injectGuardForToManyField(fieldInfo, subPayload, operation);
-                }
-                else {
-                    yield this.injectGuardForToOneField(fieldInfo, subPayload, operation);
-                }
+    injectGuardForRelationFields(db, model, payload, operation) {
+        for (const [field, subPayload] of Object.entries(payload)) {
+            if (!subPayload) {
+                continue;
             }
-        });
+            const fieldInfo = (0, model_meta_1.resolveField)(this.modelMeta, model, field);
+            if (!fieldInfo || !fieldInfo.isDataModel) {
+                continue;
+            }
+            if (fieldInfo.isArray) {
+                this.injectGuardForToManyField(db, fieldInfo, subPayload, operation);
+            }
+            else {
+                this.injectGuardForToOneField(db, fieldInfo, subPayload, operation);
+            }
+        }
     }
-    injectGuardForToManyField(fieldInfo, payload, operation) {
-        return __awaiter(this, void 0, void 0, function* () {
-            const guard = this.getAuthGuard(fieldInfo.type, operation);
-            if (payload.some) {
-                yield this.injectGuardForFields(fieldInfo.type, payload.some, operation);
-                // turn "some" into: { some: { AND: [guard, payload.some] } }
-                payload.some = this.and(payload.some, guard);
-            }
-            if (payload.none) {
-                yield this.injectGuardForFields(fieldInfo.type, payload.none, operation);
-                // turn none into: { none: { AND: [guard, payload.none] } }
-                payload.none = this.and(payload.none, guard);
-            }
-            if (payload.every &&
-                typeof payload.every === 'object' &&
-                // ignore empty every clause
-                Object.keys(payload.every).length > 0) {
-                yield this.injectGuardForFields(fieldInfo.type, payload.every, operation);
-                // turn "every" into: { none: { AND: [guard, { NOT: payload.every }] } }
-                if (!payload.none) {
-                    payload.none = {};
-                }
-                payload.none = this.and(payload.none, guard, this.not(payload.every));
-                delete payload.every;
+    injectGuardForToManyField(db, fieldInfo, payload, operation) {
+        const guard = this.getAuthGuard(db, fieldInfo.type, operation);
+        if (payload.some) {
+            this.injectGuardForRelationFields(db, fieldInfo.type, payload.some, operation);
+            // turn "some" into: { some: { AND: [guard, payload.some] } }
+            payload.some = this.and(payload.some, guard);
+        }
+        if (payload.none) {
+            this.injectGuardForRelationFields(db, fieldInfo.type, payload.none, operation);
+            // turn none into: { none: { AND: [guard, payload.none] } }
+            payload.none = this.and(payload.none, guard);
+        }
+        if (payload.every &&
+            typeof payload.every === 'object' &&
+            // ignore empty every clause
+            Object.keys(payload.every).length > 0) {
+            this.injectGuardForRelationFields(db, fieldInfo.type, payload.every, operation);
+            // turn "every" into: { none: { AND: [guard, { NOT: payload.every }] } }
+            if (!payload.none) {
+                payload.none = {};
             }
-        });
+            payload.none = this.and(payload.none, guard, this.not(payload.every));
+            delete payload.every;
+        }
     }
-    injectGuardForToOneField(fieldInfo, payload, operation) {
-        return __awaiter(this, void 0, void 0, function* () {
-            const guard = this.getAuthGuard(fieldInfo.type, operation);
-            if (payload.is || payload.isNot) {
-                if (payload.is) {
-                    yield this.injectGuardForFields(fieldInfo.type, payload.is, operation);
-                    // turn "is" into: { is: { AND: [ originalIs, guard ] }
-                    payload.is = this.and(payload.is, guard);
-                }
-                if (payload.isNot) {
-                    yield this.injectGuardForFields(fieldInfo.type, payload.isNot, operation);
-                    // turn "isNot" into: { isNot: { AND: [ originalIsNot, { NOT: guard } ] } }
-                    payload.isNot = this.and(payload.isNot, this.not(guard));
-                    delete payload.isNot;
-                }
+    injectGuardForToOneField(db, fieldInfo, payload, operation) {
+        const guard = this.getAuthGuard(db, fieldInfo.type, operation);
+        // is|isNot and flat fields conditions are mutually exclusive
+        if (payload.is || payload.isNot) {
+            if (payload.is) {
+                this.injectGuardForRelationFields(db, fieldInfo.type, payload.is, operation);
             }
-            else {
-                yield this.injectGuardForFields(fieldInfo.type, payload, operation);
-                // turn direct conditions into: { is: { AND: [ originalConditions, guard ] } }
-                const combined = this.and((0, deepcopy_1.default)(payload), guard);
-                Object.keys(payload).forEach((key) => delete payload[key]);
-                payload.is = combined;
+            if (payload.isNot) {
+                this.injectGuardForRelationFields(db, fieldInfo.type, payload.isNot, operation);
             }
-        });
+            // merge guard with existing "is": { is: [originalIs, guard] }
+            payload.is = this.and(payload.is, guard);
+        }
+        else {
+            this.injectGuardForRelationFields(db, fieldInfo.type, payload, operation);
+            // turn direct conditions into: { is: { AND: [ originalConditions, guard ] } }
+            const combined = this.and((0, deepcopy_1.default)(payload), guard);
+            Object.keys(payload).forEach((key) => delete payload[key]);
+            payload.is = combined;
+        }
     }
     /**
-     * Read model entities w.r.t the given query args. The result list
-     * are guaranteed to fully satisfy 'read' policy rules recursively.
-     *
-     * For to-many relations involved, items not satisfying policy are
-     * silently trimmed. For to-one relation, if relation data fails policy
-     * an error is thrown.
+     * Injects auth guard for read operations.
      */
-    readWithCheck(model, args) {
-        return __awaiter(this, void 0, void 0, function* () {
-            args = this.clone(args);
-            if (args.where) {
-                // query args will be used with findMany, so we need to
-                // translate unique constraint filters into a flat filter
-                // e.g.: { a_b: { a: '1', b: '1' } } => { a: '1', b: '1' }
-                yield this.flattenGeneratedUniqueField(model, args.where);
-            }
-            yield this.injectAuthGuard(args, model, 'read');
-            // recursively inject read guard conditions into the query args
-            yield this.injectNestedReadConditions(model, args);
-            if (this.shouldLogQuery) {
-                this.logger.info(`[withPolicy] \`findMany\`:\n${(0, utils_1.formatObject)(args)}`);
+    injectForRead(db, model, args) {
+        const injected = {};
+        if (!this.injectAuthGuard(db, injected, model, 'read')) {
+            return false;
+        }
+        if (args.where) {
+            // inject into relation fields:
+            //   to-many: some/none/every
+            //   to-one: direct-conditions/is/isNot
+            this.injectGuardForRelationFields(db, model, args.where, 'read');
+        }
+        if (injected.where && Object.keys(injected.where).length > 0 && !this.isTrue(injected.where)) {
+            if (!args.where) {
+                args.where = injected.where;
             }
-            const result = yield this.db[model].findMany(args);
-            yield this.postProcessForRead(result, model, args, 'read');
-            return result;
-        });
+            else {
+                this.mergeWhereClause(args.where, injected.where);
+            }
+        }
+        // recursively inject read guard conditions into nested select, include, and _count
+        const hoistedConditions = this.injectNestedReadConditions(db, model, args);
+        // the injection process may generate conditions that need to be hoisted to the toplevel,
+        // if so, merge it with the existing where
+        if (hoistedConditions.length > 0) {
+            if (!args.where) {
+                args.where = this.and(...hoistedConditions);
+            }
+            else {
+                this.mergeWhereClause(args.where, this.and(...hoistedConditions));
+            }
+        }
+        return true;
     }
     // flatten unique constraint filters
     flattenGeneratedUniqueField(model, args) {
         var _a;
-        return __awaiter(this, void 0, void 0, function* () {
-            // e.g.: { a_b: { a: '1', b: '1' } } => { a: '1', b: '1' }
-            const uniqueConstraints = (_a = this.modelMeta.uniqueConstraints) === null || _a === void 0 ? void 0 : _a[(0, lower_case_first_1.lowerCaseFirst)(model)];
-            let flattened = false;
-            if (uniqueConstraints && Object.keys(uniqueConstraints).length > 0) {
-                for (const [field, value] of Object.entries(args)) {
-                    if (uniqueConstraints[field] && typeof value === 'object') {
-                        for (const [f, v] of Object.entries(value)) {
-                            args[f] = v;
-                        }
-                        delete args[field];
-                        flattened = true;
+        // e.g.: { a_b: { a: '1', b: '1' } } => { a: '1', b: '1' }
+        const uniqueConstraints = (_a = this.modelMeta.uniqueConstraints) === null || _a === void 0 ? void 0 : _a[(0, lower_case_first_1.lowerCaseFirst)(model)];
+        if (uniqueConstraints && Object.keys(uniqueConstraints).length > 0) {
+            for (const [field, value] of Object.entries(args)) {
+                if (uniqueConstraints[field] &&
+                    uniqueConstraints[field].fields.length > 1 &&
+                    typeof value === 'object') {
+                    // multi-field unique constraint, flatten it
+                    delete args[field];
+                    for (const [f, v] of Object.entries(value)) {
+                        args[f] = v;
                     }
                 }
             }
-            if (flattened) {
-                // DEBUG
-                // this.logger.info(`Filter flattened: ${JSON.stringify(args)}`);
-            }
-        });
+        }
     }
-    injectNestedReadConditions(model, args) {
+    /**
+     * Gets unique constraints for the given model.
+     */
+    getUniqueConstraints(model) {
         var _a, _b;
-        return __awaiter(this, void 0, void 0, function* () {
-            const injectTarget = (_a = args.select) !== null && _a !== void 0 ? _a : args.include;
-            if (!injectTarget) {
-                return;
+        return (_b = (_a = this.modelMeta.uniqueConstraints) === null || _a === void 0 ? void 0 : _a[(0, lower_case_first_1.lowerCaseFirst)(model)]) !== null && _b !== void 0 ? _b : {};
+    }
+    /**
+     * Builds a reversed query for the given nested path.
+     */
+    buildReversedQuery(context, mutating = false, unsafeOperation = false) {
+        let result, currQuery;
+        let currField;
+        for (let i = context.nestingPath.length - 1; i >= 0; i--) {
+            const { field, model, where } = context.nestingPath[i];
+            // never modify the original where because it's shared in the structure
+            const visitWhere = Object.assign({}, where);
+            if (model && where) {
+                // make sure composite unique condition is flattened
+                this.flattenGeneratedUniqueField(model, visitWhere);
             }
-            if (injectTarget._count !== undefined) {
-                // _count needs to respect read policies of related models
-                if (injectTarget._count === true) {
-                    // include count for all relations, expand to all fields
-                    // so that we can inject guard conditions for each of them
-                    injectTarget._count = { select: {} };
-                    const modelFields = (0, model_meta_1.getFields)(this.modelMeta, model);
-                    if (modelFields) {
-                        for (const [k, v] of Object.entries(modelFields)) {
-                            if (v.isDataModel && v.isArray) {
-                                // create an entry for to-many relation
-                                injectTarget._count.select[k] = {};
-                            }
+            if (!result) {
+                // first segment (bottom), just use its where clause
+                result = currQuery = Object.assign({}, visitWhere);
+                currField = field;
+            }
+            else {
+                if (!currField) {
+                    throw this.unknownError(`missing field in nested path`);
+                }
+                if (!currField.backLink) {
+                    throw this.unknownError(`field ${currField.type}.${currField.name} doesn't have a backLink`);
+                }
+                const backLinkField = this.getModelField(currField.type, currField.backLink);
+                if (!backLinkField) {
+                    throw this.unknownError(`missing backLink field ${currField.backLink} in ${currField.type}`);
+                }
+                if (backLinkField.isArray) {
+                    // many-side of relationship, wrap with "some" query
+                    currQuery[currField.backLink] = { some: Object.assign({}, visitWhere) };
+                }
+                else {
+                    const fkMapping = where && backLinkField.isRelationOwner && backLinkField.foreignKeyMapping;
+                    // calculate if we should preserve the relation condition (e.g., { user: { id: 1 } })
+                    const shouldPreserveRelationCondition = 
+                    // doing a mutation
+                    mutating &&
+                        // and it's a safe mutate
+                        !unsafeOperation &&
+                        // and the current segment is the direct parent (the last one is the mutate itself),
+                        // the relation condition should be preserved and will be converted to a "connect" later
+                        i === context.nestingPath.length - 2;
+                    if (fkMapping && !shouldPreserveRelationCondition) {
+                        // turn relation condition into foreign key condition, e.g.:
+                        //     { user: { id: 1 } } => { userId: 1 }
+                        for (const [r, fk] of Object.entries(fkMapping)) {
+                            currQuery[fk] = visitWhere[r];
+                        }
+                        if (i > 0) {
+                            // prepare for the next segment
+                            currQuery[currField.backLink] = {};
                         }
                     }
-                }
-                // inject conditions for each relation
-                for (const field of Object.keys(injectTarget._count.select)) {
-                    if (typeof injectTarget._count.select[field] !== 'object') {
-                        injectTarget._count.select[field] = {};
+                    else {
+                        // preserve the original structure
+                        currQuery[currField.backLink] = Object.assign({}, visitWhere);
                     }
-                    const fieldInfo = (0, model_meta_1.resolveField)(this.modelMeta, model, field);
-                    if (!fieldInfo) {
-                        continue;
+                }
+                currQuery = currQuery[currField.backLink];
+                currField = field;
+            }
+        }
+        return result;
+    }
+    injectNestedReadConditions(db, model, args) {
+        var _a;
+        const injectTarget = (_a = args.select) !== null && _a !== void 0 ? _a : args.include;
+        if (!injectTarget) {
+            return [];
+        }
+        if (injectTarget._count !== undefined) {
+            // _count needs to respect read policies of related models
+            if (injectTarget._count === true) {
+                // include count for all relations, expand to all fields
+                // so that we can inject guard conditions for each of them
+                injectTarget._count = { select: {} };
+                const modelFields = (0, model_meta_1.getFields)(this.modelMeta, model);
+                if (modelFields) {
+                    for (const [k, v] of Object.entries(modelFields)) {
+                        if (v.isDataModel && v.isArray) {
+                            // create an entry for to-many relation
+                            injectTarget._count.select[k] = {};
+                        }
                     }
-                    // inject into the "where" clause inside select
-                    yield this.injectAuthGuard(injectTarget._count.select[field], fieldInfo.type, 'read');
                 }
             }
-            const idFields = this.getIdFields(model);
-            for (const field of (0, utils_1.getModelFields)(injectTarget)) {
+            // inject conditions for each relation
+            for (const field of Object.keys(injectTarget._count.select)) {
+                if (typeof injectTarget._count.select[field] !== 'object') {
+                    injectTarget._count.select[field] = {};
+                }
                 const fieldInfo = (0, model_meta_1.resolveField)(this.modelMeta, model, field);
-                if (!fieldInfo || !fieldInfo.isDataModel) {
-                    // only care about relation fields
+                if (!fieldInfo) {
                     continue;
                 }
-                if (fieldInfo.isArray) {
-                    if (typeof injectTarget[field] !== 'object') {
-                        injectTarget[field] = {};
-                    }
-                    // inject extra condition for to-many relation
-                    yield this.injectAuthGuard(injectTarget[field], fieldInfo.type, 'read');
-                }
-                else {
-                    // there's no way of injecting condition for to-one relation, so if there's
-                    // "select" clause we make sure 'id' fields are selected and check them against
-                    // query result; nothing needs to be done for "include" clause because all
-                    // fields are already selected
-                    if ((_b = injectTarget[field]) === null || _b === void 0 ? void 0 : _b.select) {
-                        for (const idField of idFields) {
-                            if (injectTarget[field].select[idField.name] !== true) {
-                                injectTarget[field].select[idField.name] = true;
-                            }
-                        }
-                    }
+                // inject into the "where" clause inside select
+                this.injectAuthGuard(db, injectTarget._count.select[field], fieldInfo.type, 'read');
+            }
+        }
+        // collect filter conditions that should be hoisted to the toplevel
+        const hoistedConditions = [];
+        for (const field of (0, utils_1.getModelFields)(injectTarget)) {
+            const fieldInfo = (0, model_meta_1.resolveField)(this.modelMeta, model, field);
+            if (!fieldInfo || !fieldInfo.isDataModel) {
+                // only care about relation fields
+                continue;
+            }
+            let hoisted;
+            if (fieldInfo.isArray ||
+                // Injecting where at include/select level for nullable to-one relation is supported since Prisma 4.8.0
+                // https://github.com/prisma/prisma/discussions/20350
+                fieldInfo.isOptional) {
+                if (typeof injectTarget[field] !== 'object') {
+                    injectTarget[field] = {};
+                }
+                // inject extra condition for to-many or nullable to-one relation
+                this.injectAuthGuard(db, injectTarget[field], fieldInfo.type, 'read');
+                // recurse
+                const subHoisted = this.injectNestedReadConditions(db, fieldInfo.type, injectTarget[field]);
+                if (subHoisted.length > 0) {
+                    // we can convert it to a where at this level
+                    injectTarget[field].where = this.and(injectTarget[field].where, ...subHoisted);
                 }
+            }
+            else {
+                // hoist non-nullable to-one filter to the parent level
+                hoisted = this.getAuthGuard(db, fieldInfo.type, 'read');
                 // recurse
-                yield this.injectNestedReadConditions(fieldInfo.type, injectTarget[field]);
+                const subHoisted = this.injectNestedReadConditions(db, fieldInfo.type, injectTarget[field]);
+                if (subHoisted.length > 0) {
+                    hoisted = this.and(hoisted, ...subHoisted);
+                }
             }
-        });
+            if (hoisted && !this.isTrue(hoisted)) {
+                hoistedConditions.push({ [field]: hoisted });
+            }
+        }
+        return hoistedConditions;
     }
     /**
-     * Post processing checks for read model entities. Validates to-one relations
-     * (which can't be trimmed at query time) and removes fields that should be
-     * omitted.
+     * Given a model and a unique filter, checks the operation is allowed by policies and field validations.
+     * Rejects with an error if not allowed.
      */
-    postProcessForRead(data, model, args, operation) {
-        var _a;
+    checkPolicyForUnique(model, uniqueFilter, operation, db, args, preValue) {
         return __awaiter(this, void 0, void 0, function* () {
-            for (const entityData of (0, utils_1.enumerate)(data)) {
-                if (typeof entityData !== 'object' || !entityData) {
-                    continue;
-                }
-                // strip auxiliary fields
-                for (const auxField of constants_1.AUXILIARY_FIELDS) {
-                    if (auxField in entityData) {
-                        delete entityData[auxField];
-                    }
+            let guard = this.getAuthGuard(db, model, operation, preValue);
+            if (this.isFalse(guard)) {
+                throw this.deniedByPolicy(model, operation, `entity ${(0, utils_1.formatObject)(uniqueFilter)} failed policy check`, constants_1.CrudFailureReason.ACCESS_POLICY_VIOLATION);
+            }
+            if (operation === 'update' && args) {
+                // merge field-level policy guards
+                const fieldUpdateGuard = this.getFieldUpdateGuards(db, model, args);
+                if (fieldUpdateGuard.rejectedByField) {
+                    // rejected
+                    throw this.deniedByPolicy(model, 'update', `entity ${(0, utils_1.formatObject)(uniqueFilter)} failed update policy check for field "${fieldUpdateGuard.rejectedByField}"`, constants_1.CrudFailureReason.ACCESS_POLICY_VIOLATION);
                 }
-                const injectTarget = (_a = args.select) !== null && _a !== void 0 ? _a : args.include;
-                if (!injectTarget) {
-                    continue;
+                else if (fieldUpdateGuard.guard) {
+                    // merge
+                    guard = this.and(guard, fieldUpdateGuard.guard);
                 }
-                // recurse into nested entities
-                for (const field of Object.keys(injectTarget)) {
-                    const fieldData = entityData[field];
-                    if (typeof fieldData !== 'object' || !fieldData) {
-                        continue;
-                    }
-                    const fieldInfo = (0, model_meta_1.resolveField)(this.modelMeta, model, field);
-                    if (fieldInfo) {
-                        if (fieldInfo.isDataModel && !fieldInfo.isArray) {
-                            // to-one relation data cannot be trimmed by injected guards, we have to
-                            // post-check them
-                            const ids = this.getEntityIds(fieldInfo.type, fieldData);
-                            if (Object.keys(ids).length !== 0) {
-                                // if (this.logger.enabled('info')) {
-                                //     this.logger.info(
-                                //         `Validating read of to-one relation: ${fieldInfo.type}#${formatObject(ids)}`
-                                //     );
-                                // }
-                                try {
-                                    yield this.checkPolicyForFilter(fieldInfo.type, ids, operation, this.db);
-                                }
-                                catch (err) {
-                                    if ((0, error_1.isPrismaClientKnownRequestError)(err) &&
-                                        err.code === constants_1.PrismaErrorCode.CONSTRAINED_FAILED) {
-                                        // denied by policy
-                                        if (fieldInfo.isOptional) {
-                                            // if the relation is optional, just nullify it
-                                            entityData[field] = null;
-                                        }
-                                        else {
-                                            // otherwise reject
-                                            throw err;
-                                        }
-                                    }
-                                    else {
-                                        // unknown error
-                                        throw err;
-                                    }
-                                }
-                            }
-                        }
-                        // recurse
-                        yield this.postProcessForRead(fieldData, fieldInfo.type, injectTarget[field], operation);
+            }
+            // Zod schema is to be checked for "create" and "postUpdate"
+            const schema = ['create', 'postUpdate'].includes(operation) ? this.getZodSchema(model) : undefined;
+            if (this.isTrue(guard) && !schema) {
+                // unconditionally allowed
+                return;
+            }
+            const select = schema
+                ? // need to validate against schema, need to fetch all fields
+                    undefined
+                : // only fetch id fields
+                    this.makeIdSelection(model);
+            let where = this.clone(uniqueFilter);
+            // query args may have be of combined-id form, need to flatten it to call findFirst
+            this.flattenGeneratedUniqueField(model, where);
+            // query with policy guard
+            where = this.and(where, guard);
+            const query = { select, where };
+            if (this.shouldLogQuery) {
+                this.logger.info(`[policy] checking ${model} for ${operation}, \`findFirst\`:\n${(0, utils_1.formatObject)(query)}`);
+            }
+            const result = yield db[model].findFirst(query);
+            if (!result) {
+                throw this.deniedByPolicy(model, operation, `entity ${(0, utils_1.formatObject)(uniqueFilter)} failed policy check`, constants_1.CrudFailureReason.ACCESS_POLICY_VIOLATION);
+            }
+            if (schema) {
+                // TODO: push down schema check to the database
+                const parseResult = schema.safeParse(result);
+                if (!parseResult.success) {
+                    const error = (0, zod_validation_error_1.fromZodError)(parseResult.error);
+                    if (this.logger.enabled('info')) {
+                        this.logger.info(`entity ${model} failed validation for operation ${operation}: ${error}`);
                     }
+                    throw this.deniedByPolicy(model, operation, `entities ${JSON.stringify(uniqueFilter)} failed validation: [${error}]`, constants_1.CrudFailureReason.DATA_VALIDATION_VIOLATION, parseResult.error);
                 }
             }
         });
     }
+    getFieldUpdateGuards(db, model, args) {
+        var _a;
+        const allFieldGuards = [];
+        for (const [k, v] of Object.entries((_a = args.data) !== null && _a !== void 0 ? _a : args)) {
+            if (typeof v === 'undefined') {
+                continue;
+            }
+            const fieldGuard = this.getFieldUpdateAuthGuard(db, model, k);
+            if (this.isFalse(fieldGuard)) {
+                return { guard: allFieldGuards, rejectedByField: k };
+            }
+            allFieldGuards.push(fieldGuard);
+        }
+        return { guard: this.and(...allFieldGuards), rejectedByField: undefined };
+    }
     /**
-     * Process Prisma write actions.
+     * Tries rejecting a request based on static "false" policy.
      */
-    processWrite(model, action, args, writeAction) {
+    tryReject(db, model, operation) {
+        const guard = this.getAuthGuard(db, model, operation);
+        if (this.isFalse(guard)) {
+            throw this.deniedByPolicy(model, operation, undefined, constants_1.CrudFailureReason.ACCESS_POLICY_VIOLATION);
+        }
+    }
+    /**
+     * Checks if a model exists given a unique filter.
+     */
+    checkExistence(db, model, uniqueFilter, throwIfNotFound = false) {
         return __awaiter(this, void 0, void 0, function* () {
-            // record model types for which new entities are created
-            // so we can post-check if they satisfy 'create' policies
-            const createdModels = new Set();
-            // record model entities that are updated, together with their
-            // values before update, so we can post-check if they satisfy
-            //     model => { ids, entity value }
-            const updatedModels = new Map();
-            function addUpdatedEntity(model, ids, entity) {
-                let modelEntities = updatedModels.get(model);
-                if (!modelEntities) {
-                    modelEntities = [];
-                    updatedModels.set(model, modelEntities);
-                }
-                modelEntities.push({ ids, value: entity });
-            }
-            const idFields = this.getIdFields(model);
-            if (args.select) {
-                // make sure id fields are selected, we need it to
-                // read back the updated entity
-                for (const idField of idFields) {
-                    if (!args.select[idField.name]) {
-                        args.select[idField.name] = true;
-                    }
-                }
+            uniqueFilter = this.clone(uniqueFilter);
+            this.flattenGeneratedUniqueField(model, uniqueFilter);
+            if (this.shouldLogQuery) {
+                this.logger.info(`[policy] checking ${model} existence, \`findFirst\`:\n${(0, utils_1.formatObject)(uniqueFilter)}`);
             }
-            // use a transaction to conduct write, so in case any create or nested create
-            // fails access policies, we can roll back the entire operation
-            const transactionId = (0, cuid2_1.createId)();
-            // args processor for create
-            const processCreate = (model, args) => __awaiter(this, void 0, void 0, function* () {
-                const guard = this.getAuthGuard(model, 'create');
-                const schema = this.getModelSchema(model);
-                if (guard === false) {
-                    throw this.deniedByPolicy(model, 'create');
-                }
-                else if (guard !== true || schema) {
-                    // mark the create with a transaction tag so we can check them later
-                    args[constants_1.TRANSACTION_FIELD_NAME] = `${transactionId}:create`;
-                    createdModels.add(model);
-                }
-            });
-            // build a reversed query for fetching entities affected by nested updates
-            const buildReversedQuery = (context) => __awaiter(this, void 0, void 0, function* () {
-                let result, currQuery;
-                let currField;
-                for (let i = context.nestingPath.length - 1; i >= 0; i--) {
-                    const { field, model, where, unique } = context.nestingPath[i];
-                    // never modify the original where because it's shared in the structure
-                    const visitWhere = Object.assign({}, where);
-                    if (model && where) {
-                        // make sure composite unique condition is flattened
-                        yield this.flattenGeneratedUniqueField(model, visitWhere);
-                    }
-                    if (!result) {
-                        // first segment (bottom), just use its where clause
-                        result = currQuery = Object.assign({}, visitWhere);
-                        currField = field;
-                    }
-                    else {
-                        if (!currField) {
-                            throw this.unknownError(`missing field in nested path`);
-                        }
-                        if (!currField.backLink) {
-                            throw this.unknownError(`field ${currField.type}.${currField.name} doesn't have a backLink`);
-                        }
-                        const backLinkField = this.getModelField(currField.type, currField.backLink);
-                        if (backLinkField === null || backLinkField === void 0 ? void 0 : backLinkField.isArray) {
-                            // many-side of relationship, wrap with "some" query
-                            currQuery[currField.backLink] = { some: Object.assign({}, visitWhere) };
-                        }
-                        else {
-                            currQuery[currField.backLink] = Object.assign({}, visitWhere);
-                        }
-                        currQuery = currQuery[currField.backLink];
-                        currField = field;
-                    }
-                    if (unique) {
-                        // hit a unique filter, no need to traverse further up
-                        break;
-                    }
-                }
-                return result;
-            });
-            // args processor for update/upsert
-            const processUpdate = (model, where, context) => __awaiter(this, void 0, void 0, function* () {
-                const preGuard = this.getAuthGuard(model, 'update');
-                if (preGuard === false) {
-                    throw this.deniedByPolicy(model, 'update');
-                }
-                else if (preGuard !== true) {
-                    if (this.isToOneRelation(context.field)) {
-                        // To-one relation field is complicated because there's no way to
-                        // filter it during update (args doesn't carry a 'where' clause).
-                        //
-                        // We need to recursively walk up its hierarcy in the query args
-                        // to construct a reversed query to identify the nested entity
-                        // under update, and then check if it satisfies policy.
-                        //
-                        // E.g.:
-                        // A - B - C
-                        //
-                        // update A with:
-                        // {
-                        //   where: { id: 'aId' },
-                        //   data: {
-                        //     b: {
-                        //       c: { value: 1 }
-                        //     }
-                        //   }
-                        // }
-                        //
-                        // To check if the update to 'c' field is permitted, we
-                        // reverse the query stack into a filter for C model, like:
-                        // {
-                        //   where: {
-                        //     b: { a: { id: 'aId' } }
-                        //   }
-                        // }
-                        // , and with this we can filter out the C entity that's going
-                        // to be nestedly updated, and check if it's allowed.
-                        //
-                        // The same logic applies to nested delete.
-                        const subQuery = yield buildReversedQuery(context);
-                        yield this.checkPolicyForFilter(model, subQuery, 'update', this.db);
-                    }
-                    else {
-                        if (!where) {
-                            throw this.unknownError(`Missing 'where' parameter`);
-                        }
-                        yield this.checkPolicyForFilter(model, where, 'update', this.db);
-                    }
-                }
-                yield preparePostUpdateCheck(model, context);
-            });
-            // args processor for updateMany
-            const processUpdateMany = (model, args, context) => __awaiter(this, void 0, void 0, function* () {
-                const guard = this.getAuthGuard(model, 'update');
-                if (guard === false) {
-                    throw this.deniedByPolicy(model, 'update');
-                }
-                else if (guard !== true) {
-                    // inject policy filter
-                    yield this.injectAuthGuard(args, model, 'update');
-                }
-                yield preparePostUpdateCheck(model, context);
-            });
-            // for models with post-update rules, we need to read and store
-            // entity values before the update for post-update check
-            const preparePostUpdateCheck = (model, context) => __awaiter(this, void 0, void 0, function* () {
-                const postGuard = this.getAuthGuard(model, 'postUpdate');
-                const schema = this.getModelSchema(model);
-                // post-update check is needed if there's post-update rule or validation schema
-                if (postGuard !== true || schema) {
-                    // fetch preValue selection (analyzed from the post-update rules)
-                    const preValueSelect = yield this.getPreValueSelect(model);
-                    const filter = yield buildReversedQuery(context);
-                    // query args will be used with findMany, so we need to
-                    // translate unique constraint filters into a flat filter
-                    // e.g.: { a_b: { a: '1', b: '1' } } => { a: '1', b: '1' }
-                    yield this.flattenGeneratedUniqueField(model, filter);
-                    const idFields = this.getIdFields(model);
-                    // eslint-disable-next-line @typescript-eslint/no-unused-vars
-                    const select = Object.assign({}, preValueSelect);
-                    for (const idField of idFields) {
-                        select[idField.name] = true;
-                    }
-                    const query = { where: filter, select };
-                    if (this.shouldLogQuery) {
-                        this.logger.info(`[withPolicy] \`findMany\` for fetching pre-update entities:\n${(0, utils_1.formatObject)(args)}`);
-                    }
-                    const entities = yield this.db[model].findMany(query);
-                    entities.forEach((entity) => {
-                        addUpdatedEntity(model, this.getEntityIds(model, entity), entity);
-                    });
-                }
-            });
-            // args processor for delete
-            const processDelete = (model, args, context) => __awaiter(this, void 0, void 0, function* () {
-                const guard = this.getAuthGuard(model, 'delete');
-                if (guard === false) {
-                    throw this.deniedByPolicy(model, 'delete');
-                }
-                else if (guard !== true) {
-                    if (this.isToOneRelation(context.field)) {
-                        // see comments in processUpdate
-                        const subQuery = yield buildReversedQuery(context);
-                        yield this.checkPolicyForFilter(model, subQuery, 'delete', this.db);
-                    }
-                    else {
-                        yield this.checkPolicyForFilter(model, args, 'delete', this.db);
-                    }
-                }
+            const existing = yield db[model].findFirst({
+                where: uniqueFilter,
+                select: this.makeIdSelection(model),
             });
-            // process relation updates: connect, connectOrCreate, and disconnect
-            const processRelationUpdate = (model, args, context) => __awaiter(this, void 0, void 0, function* () {
-                // CHECK ME: equire the entity being connected readable?
-                // await this.checkPolicyForFilter(model, args, 'read', this.db);
-                var _a;
-                if ((_a = context.field) === null || _a === void 0 ? void 0 : _a.backLink) {
-                    // fetch the backlink field of the model being connected
-                    const backLinkField = (0, model_meta_1.resolveField)(this.modelMeta, model, context.field.backLink);
-                    if (backLinkField.isRelationOwner) {
-                        // the target side of relation owns the relation,
-                        // mark it as updated
-                        yield processUpdate(model, args, context);
-                    }
-                }
-            });
-            // use a visitor to process args before conducting the write action
-            const visitor = new nested_write_vistor_1.NestedWriteVisitor(this.modelMeta, {
-                create: (model, args) => __awaiter(this, void 0, void 0, function* () {
-                    yield processCreate(model, args);
-                }),
-                connectOrCreate: (model, args, context) => __awaiter(this, void 0, void 0, function* () {
-                    if (args.create) {
-                        yield processCreate(model, args.create);
-                    }
-                    if (args.where) {
-                        yield processRelationUpdate(model, args.where, context);
-                    }
-                }),
-                connect: (model, args, context) => __awaiter(this, void 0, void 0, function* () {
-                    yield processRelationUpdate(model, args, context);
-                }),
-                disconnect: (model, args, context) => __awaiter(this, void 0, void 0, function* () {
-                    yield processRelationUpdate(model, args, context);
-                }),
-                update: (model, args, context) => __awaiter(this, void 0, void 0, function* () {
-                    yield processUpdate(model, args.where, context);
-                }),
-                updateMany: (model, args, context) => __awaiter(this, void 0, void 0, function* () {
-                    yield processUpdateMany(model, args, context);
-                }),
-                upsert: (model, args, context) => __awaiter(this, void 0, void 0, function* () {
-                    if (args.create) {
-                        yield processCreate(model, args.create);
-                    }
-                    if (args.update) {
-                        yield processUpdate(model, args.where, context);
-                    }
-                }),
-                delete: (model, args, context) => __awaiter(this, void 0, void 0, function* () {
-                    yield processDelete(model, args, context);
-                }),
-                // eslint-disable-next-line @typescript-eslint/no-unused-vars
-                deleteMany: (model, args, _context) => __awaiter(this, void 0, void 0, function* () {
-                    const guard = this.getAuthGuard(model, 'delete');
-                    if (guard === false) {
-                        throw this.deniedByPolicy(model, 'delete');
-                    }
-                    else if (guard !== true) {
-                        if (args.where) {
-                            args.where = this.and(args.where, guard);
-                        }
-                        else {
-                            const copy = (0, deepcopy_1.default)(args);
-                            for (const key of Object.keys(args)) {
-                                delete args[key];
-                            }
-                            const combined = this.and(copy, guard);
-                            Object.assign(args, combined);
-                        }
-                    }
-                }),
-            });
-            yield visitor.visit(model, action, args);
-            if (createdModels.size === 0 && updatedModels.size === 0) {
-                // no post-check needed, we can proceed with the write without transaction
-                return yield writeAction(this.db[model], args);
+            if (!existing && throwIfNotFound) {
+                throw this.notFound(model);
             }
-            else {
-                return yield this.transaction(this.db, (tx) => __awaiter(this, void 0, void 0, function* () {
-                    // proceed with the update (with args processed)
-                    const result = yield writeAction(tx[model], args);
-                    if (createdModels.size > 0) {
-                        // do post-check on created entities
-                        yield Promise.all([...createdModels].map((model) => this.checkPolicyForFilter(model, { [constants_1.TRANSACTION_FIELD_NAME]: `${transactionId}:create` }, 'create', tx)));
-                    }
-                    if (updatedModels.size > 0) {
-                        // do post-check on updated entities
-                        yield Promise.all([...updatedModels.entries()]
-                            .map(([model, modelEntities]) => modelEntities.map(({ ids, value: preValue }) => __awaiter(this, void 0, void 0, function* () { return this.checkPostUpdate(model, ids, tx, preValue); })))
-                            .flat());
-                    }
-                    return result;
-                }));
+            return existing;
+        });
+    }
+    /**
+     * Returns an entity given a unique filter with read policy checked. Reject if not readable.
+     */
+    readBack(db, model, operation, selectInclude, uniqueFilter) {
+        return __awaiter(this, void 0, void 0, function* () {
+            uniqueFilter = this.clone(uniqueFilter);
+            this.flattenGeneratedUniqueField(model, uniqueFilter);
+            const readArgs = { select: selectInclude.select, include: selectInclude.include, where: uniqueFilter };
+            const error = this.deniedByPolicy(model, operation, 'result is not allowed to be read back', constants_1.CrudFailureReason.RESULT_NOT_READABLE);
+            const injectResult = this.injectForRead(db, model, readArgs);
+            if (!injectResult) {
+                return { error, result: undefined };
+            }
+            // inject select needed for field-level read checks
+            this.injectReadCheckSelect(model, readArgs);
+            if (this.shouldLogQuery) {
+                this.logger.info(`[policy] checking read-back, \`findFirst\` ${model}:\n${(0, utils_1.formatObject)(readArgs)}`);
             }
+            const result = yield db[model].findFirst(readArgs);
+            if (!result) {
+                return { error, result: undefined };
+            }
+            this.postProcessForRead(result, model, selectInclude);
+            return { result, error: undefined };
         });
     }
-    getModelField(model, field) {
-        var _a;
-        model = (0, lower_case_first_1.lowerCaseFirst)(model);
-        return (_a = this.modelMeta.fields[model]) === null || _a === void 0 ? void 0 : _a[field];
+    /**
+     * Injects field selection needed for checking field-level read policy into query args.
+     * @returns
+     */
+    injectReadCheckSelect(model, args) {
+        if (!this.hasFieldLevelPolicy(model)) {
+            return;
+        }
+        const readFieldSelect = this.getReadFieldSelect(model);
+        if (!readFieldSelect) {
+            return;
+        }
+        this.doInjectReadCheckSelect(model, args, { select: readFieldSelect });
     }
-    transaction(db, action) {
-        if (db.__zenstack_tx) {
-            // already in transaction, don't nest
-            return action(db);
+    doInjectReadCheckSelect(model, args, input) {
+        if (!(input === null || input === void 0 ? void 0 : input.select)) {
+            return;
+        }
+        let target; // injection target
+        let isInclude = false; // if the target is include or select
+        if (args.select) {
+            target = args.select;
+            isInclude = false;
+        }
+        else if (args.include) {
+            target = args.include;
+            isInclude = true;
         }
         else {
-            return db.$transaction((tx) => action(tx));
+            target = args.select = this.makeAllScalarFieldSelect(model);
+            isInclude = false;
+        }
+        if (!isInclude) {
+            // merge selects
+            for (const [k, v] of Object.entries(input.select)) {
+                if (v === true) {
+                    if (!target[k]) {
+                        target[k] = true;
+                    }
+                }
+            }
+        }
+        // recurse into nested selects (relation fields)
+        for (const [k, v] of Object.entries(input.select)) {
+            if (typeof v === 'object' && (v === null || v === void 0 ? void 0 : v.select)) {
+                const field = (0, model_meta_1.resolveField)(this.modelMeta, model, k);
+                if (field === null || field === void 0 ? void 0 : field.isDataModel) {
+                    // recurse into relation
+                    if (isInclude && target[k] === true) {
+                        // select all fields for the relation
+                        target[k] = { select: this.makeAllScalarFieldSelect(field.type) };
+                    }
+                    else if (!target[k]) {
+                        // ensure an empty select clause
+                        target[k] = { select: {} };
+                    }
+                    // recurse
+                    this.doInjectReadCheckSelect(field.type, target[k], v);
+                }
+            }
         }
     }
-    deniedByPolicy(model, operation, extra, reason) {
-        return (0, utils_1.prismaClientKnownRequestError)(this.db, `denied by policy: ${model} entities failed '${operation}' check${extra ? ', ' + extra : ''}`, { clientVersion: (0, version_1.getVersion)(), code: constants_1.PrismaErrorCode.CONSTRAINED_FAILED, meta: { reason } });
+    makeAllScalarFieldSelect(model) {
+        const fields = this.modelMeta.fields[(0, lower_case_first_1.lowerCaseFirst)(model)];
+        const result = {};
+        if (fields) {
+            Object.entries(fields).forEach(([k, v]) => {
+                if (!v.isDataModel) {
+                    result[k] = true;
+                }
+            });
+        }
+        return result;
+    }
+    //#endregion
+    //#region Errors
+    deniedByPolicy(model, operation, extra, reason, zodErrors) {
+        const args = { clientVersion: (0, version_1.getVersion)(), code: constants_1.PrismaErrorCode.CONSTRAINED_FAILED, meta: {} };
+        if (reason) {
+            args.meta.reason = reason;
+        }
+        if (zodErrors) {
+            args.meta.zodErrors = zodErrors;
+        }
+        return (0, utils_1.prismaClientKnownRequestError)(this.db, `denied by policy: ${model} entities failed '${operation}' check${extra ? ', ' + extra : ''}`, args);
     }
     notFound(model) {
         return (0, utils_1.prismaClientKnownRequestError)(this.db, `entity not found for model ${model}`, {
@@ -719,122 +770,150 @@ class PolicyUtil {
             code: 'P2025',
         });
     }
+    validationError(message) {
+        return (0, utils_1.prismaClientValidationError)(this.db, message);
+    }
     unknownError(message) {
         return (0, utils_1.prismaClientUnknownRequestError)(this.db, message, {
             clientVersion: (0, version_1.getVersion)(),
         });
     }
+    //#endregion
+    //#region Misc
     /**
-     * Given a filter, check if applying access policy filtering will result
-     * in data being trimmed, and if so, throw an error.
+     * Gets field selection for fetching pre-update entity values for the given model.
      */
-    checkPolicyForFilter(model, filter, operation, db) {
-        return __awaiter(this, void 0, void 0, function* () {
-            const guard = this.getAuthGuard(model, operation);
-            const schema = (operation === 'create' || operation === 'update') && this.getModelSchema(model);
-            if (guard === true && !schema) {
-                // unconditionally allowed
-                return;
-            }
-            // if (this.logger.enabled('info')) {
-            //     this.logger.info(`Checking policy for ${model}#${JSON.stringify(filter)} for ${operation}`);
-            // }
-            const queryFilter = (0, deepcopy_1.default)(filter);
-            // query args will be used with findMany, so we need to
-            // translate unique constraint filters into a flat filter
-            // e.g.: { a_b: { a: '1', b: '1' } } => { a: '1', b: '1' }
-            yield this.flattenGeneratedUniqueField(model, queryFilter);
-            const countArgs = { where: queryFilter };
-            // if (this.shouldLogQuery) {
-            //     this.logger.info(
-            //         `[withPolicy] \`count\` for policy check without guard:\n${formatObject(countArgs)}`
-            //     );
-            // }
-            const count = (yield db[model].count(countArgs));
-            if (count === 0) {
-                // there's nothing to filter out
+    getPreValueSelect(model) {
+        const guard = this.policy.guard[(0, lower_case_first_1.lowerCaseFirst)(model)];
+        if (!guard) {
+            throw this.unknownError(`unable to load policy guard for ${model}`);
+        }
+        return guard[constants_1.PRE_UPDATE_VALUE_SELECTOR];
+    }
+    getReadFieldSelect(model) {
+        const guard = this.policy.guard[(0, lower_case_first_1.lowerCaseFirst)(model)];
+        if (!guard) {
+            throw this.unknownError(`unable to load policy guard for ${model}`);
+        }
+        return guard[constants_1.FIELD_LEVEL_READ_CHECKER_SELECTOR];
+    }
+    checkReadField(model, field, entity) {
+        const guard = this.policy.guard[(0, lower_case_first_1.lowerCaseFirst)(model)];
+        if (!guard) {
+            throw this.unknownError(`unable to load policy guard for ${model}`);
+        }
+        const func = guard[`${constants_1.FIELD_LEVEL_READ_CHECKER_PREFIX}${field}`];
+        if (!func) {
+            return true;
+        }
+        else {
+            return func(entity, { user: this.user });
+        }
+    }
+    hasFieldValidation(model) {
+        var _a, _b;
+        return ((_b = (_a = this.policy.validation) === null || _a === void 0 ? void 0 : _a[(0, lower_case_first_1.lowerCaseFirst)(model)]) === null || _b === void 0 ? void 0 : _b.hasValidation) === true;
+    }
+    hasFieldLevelPolicy(model) {
+        const guard = this.policy.guard[(0, lower_case_first_1.lowerCaseFirst)(model)];
+        if (!guard) {
+            throw this.unknownError(`unable to load policy guard for ${model}`);
+        }
+        return !!guard[constants_1.HAS_FIELD_LEVEL_POLICY_FLAG];
+    }
+    /**
+     * Gets Zod schema for the given model and access kind.
+     *
+     * @param kind If undefined, returns the full schema.
+     */
+    getZodSchema(model, kind = undefined) {
+        var _a, _b;
+        if (!this.hasFieldValidation(model)) {
+            return undefined;
+        }
+        const schemaKey = `${(0, upper_case_first_1.upperCaseFirst)(model)}${kind ? (0, upper_case_first_1.upperCaseFirst)(kind) : ''}Schema`;
+        return (_b = (_a = this.zodSchemas) === null || _a === void 0 ? void 0 : _a.models) === null || _b === void 0 ? void 0 : _b[schemaKey];
+    }
+    /**
+     * Post processing checks and clean-up for read model entities.
+     */
+    postProcessForRead(data, model, queryArgs) {
+        // preserve the original data as it may be needed for checking field-level readability,
+        // while the "data" will be manipulated during traversal (deleting unreadable fields)
+        const origData = this.clone(data);
+        this.doPostProcessForRead(data, model, origData, queryArgs, this.hasFieldLevelPolicy(model));
+    }
+    doPostProcessForRead(data, model, fullData, queryArgs, hasFieldLevelPolicy, path = '') {
+        var _a, _b;
+        if (data === null || data === undefined) {
+            return;
+        }
+        for (const [entityData, entityFullData] of (0, utils_1.zip)(data, fullData)) {
+            if (typeof entityData !== 'object' || !entityData) {
                 return;
             }
-            if (guard === false) {
-                // unconditionally denied
-                throw this.deniedByPolicy(model, operation, `${count} ${(0, pluralize_1.default)('entity', count)} failed policy check`);
-            }
-            // build a query condition with policy injected
-            const guardedQuery = { where: this.and(queryFilter, guard) };
-            if (schema) {
-                // we've got schemas, so have to fetch entities and validate them
-                // if (this.shouldLogQuery) {
-                //     this.logger.info(
-                //         `[withPolicy] \`findMany\` for policy check with guard:\n${formatObject(countArgs)}`
-                //     );
-                // }
-                const entities = yield db[model].findMany(guardedQuery);
-                if (entities.length < count) {
-                    if (this.logger.enabled('info')) {
-                        this.logger.info(`entity ${model} failed policy check for operation ${operation}`);
-                    }
-                    throw this.deniedByPolicy(model, operation, `${count - entities.length} ${(0, pluralize_1.default)('entity', count - entities.length)} failed policy check`);
+            for (const [field, fieldData] of Object.entries(entityData)) {
+                if (fieldData === undefined) {
+                    continue;
                 }
-                // TODO: push down schema check to the database
-                const schemaCheckErrors = entities.map((entity) => schema.safeParse(entity)).filter((r) => !r.success);
-                if (schemaCheckErrors.length > 0) {
-                    const error = schemaCheckErrors.map((r) => !r.success && (0, zod_validation_error_1.fromZodError)(r.error).message).join(', ');
-                    if (this.logger.enabled('info')) {
-                        this.logger.info(`entity ${model} failed schema check for operation ${operation}: ${error}`);
-                    }
-                    throw this.deniedByPolicy(model, operation, `entities failed schema check: [${error}]`, constants_1.CrudFailureReason.DATA_VALIDATION_VIOLATION);
+                const fieldInfo = (0, model_meta_1.resolveField)(this.modelMeta, model, field);
+                if (!fieldInfo) {
+                    // could be _count, etc.
+                    continue;
                 }
-            }
-            else {
-                // count entities with policy injected and see if any of them are filtered out
-                // if (this.shouldLogQuery) {
-                //     this.logger.info(
-                //         `[withPolicy] \`count\` for policy check with guard:\n${formatObject(guardedQuery)}`
-                //     );
-                // }
-                const guardedCount = (yield db[model].count(guardedQuery));
-                if (guardedCount < count) {
-                    if (this.logger.enabled('info')) {
-                        this.logger.info(`entity ${model} failed policy check for operation ${operation}`);
+                if (hasFieldLevelPolicy) {
+                    // 1. remove fields selected for checking field-level policies but not selected by the original query args
+                    // 2. evaluate field-level policies and remove fields that are not readable
+                    if (!fieldInfo.isDataModel) {
+                        // scalar field, delete unselected ones
+                        const select = queryArgs === null || queryArgs === void 0 ? void 0 : queryArgs.select;
+                        if (select && typeof select === 'object' && select[field] !== true) {
+                            // there's a select clause but this field is not included
+                            delete entityData[field];
+                            continue;
+                        }
                     }
-                    throw this.deniedByPolicy(model, operation, `${count - guardedCount} ${(0, pluralize_1.default)('entity', count - guardedCount)} failed policy check`);
-                }
-            }
-        });
-    }
-    checkPostUpdate(model, ids, db, preValue) {
-        return __awaiter(this, void 0, void 0, function* () {
-            // if (this.logger.enabled('info')) {
-            //     this.logger.info(`Checking post-update policy for ${model}#${ids}, preValue: ${formatObject(preValue)}`);
-            // }
-            const guard = this.getAuthGuard(model, 'postUpdate', preValue);
-            // build a query condition with policy injected
-            const guardedQuery = { where: this.and(ids, guard) };
-            // query with policy injected
-            const entity = yield db[model].findFirst(guardedQuery);
-            // see if we get fewer items with policy, if so, reject with an throw
-            if (!entity) {
-                if (this.logger.enabled('info')) {
-                    this.logger.info(`entity ${model} failed policy check for operation postUpdate`);
-                }
-                throw this.deniedByPolicy(model, 'postUpdate');
-            }
-            // TODO: push down schema check to the database
-            const schema = this.getModelSchema(model);
-            if (schema) {
-                const schemaCheckResult = schema.safeParse(entity);
-                if (!schemaCheckResult.success) {
-                    const error = (0, zod_validation_error_1.fromZodError)(schemaCheckResult.error).message;
-                    if (this.logger.enabled('info')) {
-                        this.logger.info(`entity ${model} failed schema check for operation postUpdate: ${error}`);
+                    else {
+                        // relation field, delete if not selected or included
+                        const include = queryArgs === null || queryArgs === void 0 ? void 0 : queryArgs.include;
+                        const select = queryArgs === null || queryArgs === void 0 ? void 0 : queryArgs.select;
+                        if (!(include === null || include === void 0 ? void 0 : include[field]) && !(select === null || select === void 0 ? void 0 : select[field])) {
+                            // relation field not included or selected
+                            delete entityData[field];
+                            continue;
+                        }
+                    }
+                    // delete unreadable fields
+                    if (!this.checkReadField(model, field, entityFullData)) {
+                        if (this.shouldLogQuery) {
+                            this.logger.info(`[policy] dropping unreadable field ${path ? path + '.' : ''}${field}`);
+                        }
+                        delete entityData[field];
+                        continue;
                     }
-                    throw this.deniedByPolicy(model, 'postUpdate', `entity failed schema check: ${error}`);
+                }
+                if (fieldInfo.isDataModel) {
+                    // recurse into nested fields
+                    const nextArgs = (_b = ((_a = queryArgs === null || queryArgs === void 0 ? void 0 : queryArgs.select) !== null && _a !== void 0 ? _a : queryArgs === null || queryArgs === void 0 ? void 0 : queryArgs.include)) === null || _b === void 0 ? void 0 : _b[field];
+                    this.doPostProcessForRead(fieldData, fieldInfo.type, entityFullData[field], nextArgs, hasFieldLevelPolicy, path ? path + '.' + field : field);
                 }
             }
-        });
+        }
     }
-    isToOneRelation(field) {
-        return !!field && field.isDataModel && !field.isArray;
+    /**
+     * Gets information for all fields of a model.
+     */
+    getModelFields(model) {
+        model = (0, lower_case_first_1.lowerCaseFirst)(model);
+        return this.modelMeta.fields[model];
+    }
+    /**
+     * Gets information for a specific model field.
+     */
+    getModelField(model, field) {
+        var _a;
+        model = (0, lower_case_first_1.lowerCaseFirst)(model);
+        return (_a = this.modelMeta.fields[model]) === null || _a === void 0 ? void 0 : _a[field];
     }
     /**
      * Clones an object and makes sure it's not empty.
@@ -843,13 +922,13 @@ class PolicyUtil {
         return value ? (0, deepcopy_1.default)(value) : {};
     }
     /**
-     * Gets "id" field for a given model.
+     * Gets "id" fields for a given model.
      */
     getIdFields(model) {
         return (0, utils_1.getIdFields)(this.modelMeta, model, true);
     }
     /**
-     * Gets id field value from an entity.
+     * Gets id field values from an entity.
      */
     getEntityIds(model, entityData) {
         const idFields = this.getIdFields(model);
@@ -859,8 +938,36 @@ class PolicyUtil {
         }
         return result;
     }
-    get shouldLogQuery() {
-        return this.logPrismaQuery && this.logger.enabled('info');
+    /**
+     * Creates a selection object for id fields for the given model.
+     */
+    makeIdSelection(model) {
+        const idFields = this.getIdFields(model);
+        return Object.assign({}, ...idFields.map((f) => ({ [f.name]: true })));
+    }
+    mergeWhereClause(where, extra) {
+        var _a;
+        if (!where) {
+            throw new Error('invalid where clause');
+        }
+        if (this.isTrue(extra)) {
+            return;
+        }
+        // instead of simply wrapping with AND, we preserve the structure
+        // of the original where clause and merge `extra` into it so that
+        // unique query can continue working
+        if (where.AND) {
+            // merge into existing AND clause
+            const conditions = Array.isArray(where.AND) ? [...where.AND] : [where.AND];
+            conditions.push(extra);
+            const combined = this.and(...conditions);
+            // make sure the merging always goes under AND
+            where.AND = (_a = combined.AND) !== null && _a !== void 0 ? _a : combined;
+        }
+        else {
+            // insert an AND clause
+            where.AND = [extra];
+        }
     }
 }
 exports.PolicyUtil = PolicyUtil;