@zenstackhq/runtime 1.10.0 → 2.0.0-alpha.2

package/enhancements/policy/handler.js

@@ -31,26 +31,24 @@ const upper_case_first_1 = require("upper-case-first");
 const zod_validation_error_1 = require("zod-validation-error");
 const constants_1 = require("../../constants");
 const cross_1 = require("../../cross");
+const logger_1 = require("../logger");
+const query_utils_1 = require("../query-utils");
 const utils_1 = require("../utils");
-const logger_1 = require("./logger");
 const policy_utils_1 = require("./policy-utils");
 const promise_1 = require("./promise");
 /**
  * Prisma proxy handler for injecting access policy check.
  */
 class PolicyProxyHandler {
-    constructor(prisma, policy, modelMeta, zodSchemas, model, user, options) {
+    constructor(prisma, model, options, context) {
         this.prisma = prisma;
-        this.policy = policy;
-        this.modelMeta = modelMeta;
-        this.zodSchemas = zodSchemas;
-        this.user = user;
         this.options = options;
-        this.DEFAULT_TX_MAXWAIT = 100000;
-        this.DEFAULT_TX_TIMEOUT = 100000;
+        this.context = context;
         this.logger = new logger_1.Logger(prisma);
-        this.utils = new policy_utils_1.PolicyUtil(this.prisma, this.modelMeta, this.policy, this.zodSchemas, this.user, this.shouldLogQuery);
         this.model = (0, lower_case_first_1.lowerCaseFirst)(model);
+        ({ modelMeta: this.modelMeta, prismaModule: this.prismaModule } = options);
+        this.policyUtils = new policy_utils_1.PolicyUtil(prisma, options, context, this.shouldLogQuery);
+        this.queryUtils = new query_utils_1.QueryUtils(prisma, options);
     }
     get modelClient() {
         return this.prisma[this.model];
@@ -59,22 +57,22 @@ class PolicyProxyHandler {
     // find operations behaves as if the entities that don't match access policies don't exist
     findUnique(args) {
         if (!args) {
-            throw (0, utils_1.prismaClientValidationError)(this.prisma, 'query argument is required');
+            throw (0, utils_1.prismaClientValidationError)(this.prisma, this.prismaModule, 'query argument is required');
         }
         if (!args.where) {
-            throw (0, utils_1.prismaClientValidationError)(this.prisma, 'where field is required in query argument');
+            throw (0, utils_1.prismaClientValidationError)(this.prisma, this.prismaModule, 'where field is required in query argument');
         }
         return this.findWithFluentCallStubs(args, 'findUnique', false, () => null);
     }
     findUniqueOrThrow(args) {
         if (!args) {
-            throw (0, utils_1.prismaClientValidationError)(this.prisma, 'query argument is required');
+            throw (0, utils_1.prismaClientValidationError)(this.prisma, this.prismaModule, 'query argument is required');
         }
         if (!args.where) {
-            throw (0, utils_1.prismaClientValidationError)(this.prisma, 'where field is required in query argument');
+            throw (0, utils_1.prismaClientValidationError)(this.prisma, this.prismaModule, 'where field is required in query argument');
         }
         return this.findWithFluentCallStubs(args, 'findUniqueOrThrow', true, () => {
-            throw this.utils.notFound(this.model);
+            throw this.policyUtils.notFound(this.model);
         });
     }
     findFirst(args) {
@@ -82,7 +80,7 @@ class PolicyProxyHandler {
     }
     findFirstOrThrow(args) {
         return this.findWithFluentCallStubs(args, 'findFirstOrThrow', true, () => {
-            throw this.utils.notFound(this.model);
+            throw this.policyUtils.notFound(this.model);
         });
     }
     findMany(args) {
@@ -97,17 +95,20 @@ class PolicyProxyHandler {
     }
     doFind(args, actionName, handleRejection) {
         const origArgs = args;
-        const _args = this.utils.clone(args);
-        if (!this.utils.injectForRead(this.prisma, this.model, _args)) {
+        const _args = this.policyUtils.clone(args);
+        if (!this.policyUtils.injectForRead(this.prisma, this.model, _args)) {
+            if (this.shouldLogQuery) {
+                this.logger.info(`[policy] \`${actionName}\` ${this.model}: unconditionally denied`);
+            }
             return handleRejection();
         }
-        this.utils.injectReadCheckSelect(this.model, _args);
+        this.policyUtils.injectReadCheckSelect(this.model, _args);
         if (this.shouldLogQuery) {
             this.logger.info(`[policy] \`${actionName}\` ${this.model}:\n${(0, utils_1.formatObject)(_args)}`);
         }
         return new Promise((resolve, reject) => {
             this.modelClient[actionName](_args).then((value) => {
-                this.utils.postProcessForRead(value, this.model, origArgs);
+                this.policyUtils.postProcessForRead(value, this.model, origArgs);
                 resolve(value);
             }, (err) => reject(err));
         });
@@ -115,13 +116,13 @@ class PolicyProxyHandler {
     // returns a fluent API call function
     fluentCall(filter, fieldInfo, rootPromise) {
         return (args) => {
-            args = this.utils.clone(args);
+            args = this.policyUtils.clone(args);
             // combine the parent filter with the current one
             const backLinkField = this.requireBackLink(fieldInfo);
             const condition = backLinkField.isArray
                 ? { [backLinkField.name]: { some: filter } }
                 : { [backLinkField.name]: { is: filter } };
-            args.where = this.utils.and(args.where, condition);
+            args.where = this.policyUtils.and(args.where, condition);
             const promise = (0, promise_1.createDeferredPromise)(() => {
                 // Promise for fetching
                 const fetchFluent = (resolve, reject) => {
@@ -155,7 +156,7 @@ class PolicyProxyHandler {
     }
     // add fluent API functions to the given promise
     addFluentFunctions(promise, model, filter, rootPromise) {
-        const fields = this.utils.getModelFields(model);
+        const fields = this.policyUtils.getModelFields(model);
         if (fields) {
             for (const [field, fieldInfo] of Object.entries(fields)) {
                 if (fieldInfo.isDataModel) {
@@ -169,21 +170,21 @@ class PolicyProxyHandler {
     create(args) {
         return __awaiter(this, void 0, void 0, function* () {
             if (!args) {
-                throw (0, utils_1.prismaClientValidationError)(this.prisma, 'query argument is required');
+                throw (0, utils_1.prismaClientValidationError)(this.prisma, this.prismaModule, 'query argument is required');
             }
             if (!args.data) {
-                throw (0, utils_1.prismaClientValidationError)(this.prisma, 'data field is required in query argument');
+                throw (0, utils_1.prismaClientValidationError)(this.prisma, this.prismaModule, 'data field is required in query argument');
             }
-            this.utils.tryReject(this.prisma, this.model, 'create');
+            this.policyUtils.tryReject(this.prisma, this.model, 'create');
             const origArgs = args;
-            args = this.utils.clone(args);
+            args = this.policyUtils.clone(args);
             // static input policy check for top-level create data
-            const inputCheck = this.utils.checkInputGuard(this.model, args.data, 'create');
+            const inputCheck = this.policyUtils.checkInputGuard(this.model, args.data, 'create');
             if (inputCheck === false) {
-                throw this.utils.deniedByPolicy(this.model, 'create', undefined, constants_1.CrudFailureReason.ACCESS_POLICY_VIOLATION);
+                throw this.policyUtils.deniedByPolicy(this.model, 'create', undefined, constants_1.CrudFailureReason.ACCESS_POLICY_VIOLATION);
             }
             const hasNestedCreateOrConnect = yield this.hasNestedCreateOrConnect(args);
-            const { result, error } = yield this.transaction((tx) => __awaiter(this, void 0, void 0, function* () {
+            const { result, error } = yield this.queryUtils.transaction(this.prisma, (tx) => __awaiter(this, void 0, void 0, function* () {
                 if (
                 // MUST check true here since inputCheck can be undefined (meaning static input check not possible)
                 inputCheck === true &&
@@ -193,13 +194,13 @@ class PolicyProxyHandler {
                     // validate zod schema if any
                     args.data = this.validateCreateInputSchema(this.model, args.data);
                     // make a create args only containing data and ID selection
-                    const createArgs = { data: args.data, select: this.utils.makeIdSelection(this.model) };
+                    const createArgs = { data: args.data, select: this.policyUtils.makeIdSelection(this.model) };
                     if (this.shouldLogQuery) {
                         this.logger.info(`[policy] \`create\` ${this.model}: ${(0, utils_1.formatObject)(createArgs)}`);
                     }
                     const result = yield tx[this.model].create(createArgs);
                     // filter the read-back data
-                    return this.utils.readBack(tx, this.model, 'create', args, result);
+                    return this.policyUtils.readBack(tx, this.model, 'create', args, result);
                 }
                 else {
                     // proceed with a complex create and collect post-write checks
@@ -207,7 +208,7 @@ class PolicyProxyHandler {
                     // execute post-write checks
                     yield this.runPostWriteChecks(postWriteChecks, tx);
                     // filter the read-back data
-                    return this.utils.readBack(tx, this.model, 'create', origArgs, result);
+                    return this.policyUtils.readBack(tx, this.model, 'create', origArgs, result);
                 }
             }));
             if (error) {
@@ -242,7 +243,7 @@ class PolicyProxyHandler {
                 create: (model, args, context) => __awaiter(this, void 0, void 0, function* () {
                     const validateResult = this.validateCreateInputSchema(model, args);
                     if (validateResult !== args) {
-                        this.utils.replace(args, validateResult);
+                        this.policyUtils.replace(args, validateResult);
                     }
                     pushIdFields(model, context);
                 }),
@@ -250,7 +251,7 @@ class PolicyProxyHandler {
                     (0, cross_1.enumerate)(args.data).forEach((item) => {
                         const r = this.validateCreateInputSchema(model, item);
                         if (r !== item) {
-                            this.utils.replace(item, r);
+                            this.policyUtils.replace(item, r);
                         }
                     });
                     pushIdFields(model, context);
@@ -258,12 +259,12 @@ class PolicyProxyHandler {
                 connectOrCreate: (model, args, context) => __awaiter(this, void 0, void 0, function* () {
                     var _a;
                     if (!args.where) {
-                        throw this.utils.validationError(`'where' field is required for connectOrCreate`);
+                        throw this.policyUtils.validationError(`'where' field is required for connectOrCreate`);
                     }
                     if (args.create) {
                         args.create = this.validateCreateInputSchema(model, args.create);
                     }
-                    const existing = yield this.utils.checkExistence(db, model, args.where);
+                    const existing = yield this.policyUtils.checkExistence(db, model, args.where);
                     if (existing) {
                         // connect case
                         if ((_a = context.field) === null || _a === void 0 ? void 0 : _a.backLink) {
@@ -271,7 +272,7 @@ class PolicyProxyHandler {
                             if (backLinkField === null || backLinkField === void 0 ? void 0 : backLinkField.isRelationOwner) {
                                 // the target side of relation owns the relation,
                                 // check if it's updatable
-                                yield this.utils.checkPolicyForUnique(model, args.where, 'update', db, args);
+                                yield this.policyUtils.checkPolicyForUnique(model, args.where, 'update', db, args);
                             }
                         }
                         if (context.parent.connect) {
@@ -304,16 +305,16 @@ class PolicyProxyHandler {
                 connect: (model, args, context) => __awaiter(this, void 0, void 0, function* () {
                     var _b;
                     if (!args || typeof args !== 'object' || Object.keys(args).length === 0) {
-                        throw this.utils.validationError(`'connect' field must be an non-empty object`);
+                        throw this.policyUtils.validationError(`'connect' field must be an non-empty object`);
                     }
                     if ((_b = context.field) === null || _b === void 0 ? void 0 : _b.backLink) {
                         const backLinkField = (0, cross_1.resolveField)(this.modelMeta, model, context.field.backLink);
                         if (backLinkField === null || backLinkField === void 0 ? void 0 : backLinkField.isRelationOwner) {
                             // check existence
-                            yield this.utils.checkExistence(db, model, args, true);
+                            yield this.policyUtils.checkExistence(db, model, args, true);
                             // the target side of relation owns the relation,
                             // check if it's updatable
-                            yield this.utils.checkPolicyForUnique(model, args, 'update', db, args);
+                            yield this.policyUtils.checkPolicyForUnique(model, args, 'update', db, args);
                         }
                     }
                 }),
@@ -352,7 +353,7 @@ class PolicyProxyHandler {
                 }
             });
             // return only the ids of the top-level entity
-            const ids = this.utils.getEntityIds(this.model, result);
+            const ids = this.policyUtils.getEntityIds(this.model, result);
             return { result: ids, postWriteChecks: [...postCreateChecks.values()] };
         });
     }
@@ -397,11 +398,11 @@ class PolicyProxyHandler {
     }
     // Validates the given create payload against Zod schema if any
     validateCreateInputSchema(model, data) {
-        const schema = this.utils.getZodSchema(model, 'create');
+        const schema = this.policyUtils.getZodSchema(model, 'create');
         if (schema && data) {
             const parseResult = schema.safeParse(data);
             if (!parseResult.success) {
-                throw this.utils.deniedByPolicy(model, 'create', `input failed validation: ${(0, zod_validation_error_1.fromZodError)(parseResult.error)}`, constants_1.CrudFailureReason.DATA_VALIDATION_VIOLATION, parseResult.error);
+                throw this.policyUtils.deniedByPolicy(model, 'create', `input failed validation: ${(0, zod_validation_error_1.fromZodError)(parseResult.error)}`, constants_1.CrudFailureReason.DATA_VALIDATION_VIOLATION, parseResult.error);
             }
             return parseResult.data;
         }
@@ -412,25 +413,25 @@ class PolicyProxyHandler {
     createMany(args) {
         return __awaiter(this, void 0, void 0, function* () {
             if (!args) {
-                throw (0, utils_1.prismaClientValidationError)(this.prisma, 'query argument is required');
+                throw (0, utils_1.prismaClientValidationError)(this.prisma, this.prismaModule, 'query argument is required');
             }
             if (!args.data) {
-                throw (0, utils_1.prismaClientValidationError)(this.prisma, 'data field is required in query argument');
+                throw (0, utils_1.prismaClientValidationError)(this.prisma, this.prismaModule, 'data field is required in query argument');
             }
-            this.utils.tryReject(this.prisma, this.model, 'create');
-            args = this.utils.clone(args);
+            this.policyUtils.tryReject(this.prisma, this.model, 'create');
+            args = this.policyUtils.clone(args);
             // go through create items, statically check input to determine if post-create
             // check is needed, and also validate zod schema
             let needPostCreateCheck = false;
             for (const item of (0, cross_1.enumerate)(args.data)) {
                 const validationResult = this.validateCreateInputSchema(this.model, item);
                 if (validationResult !== item) {
-                    this.utils.replace(item, validationResult);
+                    this.policyUtils.replace(item, validationResult);
                 }
-                const inputCheck = this.utils.checkInputGuard(this.model, item, 'create');
+                const inputCheck = this.policyUtils.checkInputGuard(this.model, item, 'create');
                 if (inputCheck === false) {
                     // unconditionally deny
-                    throw this.utils.deniedByPolicy(this.model, 'create', undefined, constants_1.CrudFailureReason.ACCESS_POLICY_VIOLATION);
+                    throw this.policyUtils.deniedByPolicy(this.model, 'create', undefined, constants_1.CrudFailureReason.ACCESS_POLICY_VIOLATION);
                 }
                 else if (inputCheck === true) {
                     // unconditionally allow
@@ -445,7 +446,7 @@ class PolicyProxyHandler {
             }
             else {
                 // create entities in a transaction with post-create checks
-                return this.transaction((tx) => __awaiter(this, void 0, void 0, function* () {
+                return this.queryUtils.transaction(this.prisma, (tx) => __awaiter(this, void 0, void 0, function* () {
                     const { result, postWriteChecks } = yield this.doCreateMany(this.model, args, tx);
                     // post-create check
                     yield this.runPostWriteChecks(postWriteChecks, tx);
@@ -470,7 +471,7 @@ class PolicyProxyHandler {
                 if (this.shouldLogQuery) {
                     this.logger.info(`[policy] \`create\` for \`createMany\` ${model}: ${(0, utils_1.formatObject)(item)}`);
                 }
-                return yield db[model].create({ select: this.utils.makeIdSelection(model), data: item });
+                return yield db[model].create({ select: this.policyUtils.makeIdSelection(model), data: item });
             })));
             // filter undefined values due to skipDuplicates
             createResult = createResult.filter((p) => !!p);
@@ -491,11 +492,11 @@ class PolicyProxyHandler {
             // TODO: for simple cases we should be able to translate it to an `upsert` with empty `update` payload
             // for each unique constraint, check if the input item has all fields set, and if so, check if
             // an entity already exists, and ignore accordingly
-            const uniqueConstraints = this.utils.getUniqueConstraints(model);
+            const uniqueConstraints = this.policyUtils.getUniqueConstraints(model);
             for (const constraint of Object.values(uniqueConstraints)) {
                 if (constraint.fields.every((f) => createData[f] !== undefined)) {
                     const uniqueFilter = constraint.fields.reduce((acc, f) => (Object.assign(Object.assign({}, acc), { [f]: createData[f] })), {});
-                    const existing = yield this.utils.checkExistence(db, model, uniqueFilter);
+                    const existing = yield this.policyUtils.checkExistence(db, model, uniqueFilter);
                     if (existing) {
                         return true;
                     }
@@ -514,22 +515,22 @@ class PolicyProxyHandler {
     update(args) {
         return __awaiter(this, void 0, void 0, function* () {
             if (!args) {
-                throw (0, utils_1.prismaClientValidationError)(this.prisma, 'query argument is required');
+                throw (0, utils_1.prismaClientValidationError)(this.prisma, this.prismaModule, 'query argument is required');
             }
             if (!args.where) {
-                throw (0, utils_1.prismaClientValidationError)(this.prisma, 'where field is required in query argument');
+                throw (0, utils_1.prismaClientValidationError)(this.prisma, this.prismaModule, 'where field is required in query argument');
             }
             if (!args.data) {
-                throw (0, utils_1.prismaClientValidationError)(this.prisma, 'data field is required in query argument');
+                throw (0, utils_1.prismaClientValidationError)(this.prisma, this.prismaModule, 'data field is required in query argument');
             }
-            args = this.utils.clone(args);
-            const { result, error } = yield this.transaction((tx) => __awaiter(this, void 0, void 0, function* () {
+            args = this.policyUtils.clone(args);
+            const { result, error } = yield this.queryUtils.transaction(this.prisma, (tx) => __awaiter(this, void 0, void 0, function* () {
                 // proceed with nested writes and collect post-write checks
                 const { result, postWriteChecks } = yield this.doUpdate(args, tx);
                 // post-write check
                 yield this.runPostWriteChecks(postWriteChecks, tx);
                 // filter the read-back data
-                return this.utils.readBack(tx, this.model, 'update', args, result);
+                return this.policyUtils.readBack(tx, this.model, 'update', args, result);
             }));
             if (error) {
                 throw error;
@@ -546,10 +547,10 @@ class PolicyProxyHandler {
             // registers a post-update check task
             const _registerPostUpdateCheck = (model, uniqueFilter) => __awaiter(this, void 0, void 0, function* () {
                 // both "post-update" rules and Zod schemas require a post-update check
-                if (this.utils.hasAuthGuard(model, 'postUpdate') || this.utils.getZodSchema(model)) {
+                if (this.policyUtils.hasAuthGuard(model, 'postUpdate') || this.policyUtils.getZodSchema(model)) {
                     // select pre-update field values
                     let preValue;
-                    const preValueSelect = this.utils.getPreValueSelect(model);
+                    const preValueSelect = this.policyUtils.getPreValueSelect(model);
                     if (preValueSelect && Object.keys(preValueSelect).length > 0) {
                         preValue = yield db[model].findFirst({ where: uniqueFilter, select: preValueSelect });
                     }
@@ -572,9 +573,9 @@ class PolicyProxyHandler {
                     // operations. E.g.:
                     //     - safe: { data: { user: { connect: { id: 1 }} } }
                     //     - unsafe: { data: { userId: 1 } }
-                    const unsafe = this.isUnsafeMutate(model, args);
+                    const unsafe = (0, utils_1.isUnsafeMutate)(model, args, this.modelMeta);
                     // handles the connection to upstream entity
-                    const reversedQuery = this.utils.buildReversedQuery(context, true, unsafe);
+                    const reversedQuery = this.policyUtils.buildReversedQuery(context, true, unsafe);
                     if ((!unsafe || context.field.isRelationOwner) && reversedQuery[context.field.backLink]) {
                         // if mutation is safe, or current field owns the relation (so the other side has no fk),
                         // and the reverse query contains the back link, then we can build a "connect" with it
@@ -602,7 +603,7 @@ class PolicyProxyHandler {
                             // for example when it's nested inside a one-to-one update
                             const upstreamQuery = {
                                 where: reversedQuery[backLinkField.name],
-                                select: this.utils.makeIdSelection(backLinkField.type),
+                                select: this.policyUtils.makeIdSelection(backLinkField.type),
                             };
                             // fetch the upstream entity
                             if (this.logger.enabled('info')) {
@@ -639,8 +640,8 @@ class PolicyProxyHandler {
             const _connectDisconnect = (model, args, context) => __awaiter(this, void 0, void 0, function* () {
                 var _b;
                 if ((_b = context.field) === null || _b === void 0 ? void 0 : _b.backLink) {
-                    const backLinkField = this.utils.getModelField(model, context.field.backLink);
-                    if (backLinkField.isRelationOwner) {
+                    const backLinkField = this.policyUtils.getModelField(model, context.field.backLink);
+                    if (backLinkField === null || backLinkField === void 0 ? void 0 : backLinkField.isRelationOwner) {
                         // update happens on the related model, require updatable,
                         // translate args to foreign keys so field-level policies can be checked
                         const checkArgs = {};
@@ -652,7 +653,7 @@ class PolicyProxyHandler {
                                 }
                             }
                         }
-                        yield this.utils.checkPolicyForUnique(model, args, 'update', db, checkArgs);
+                        yield this.policyUtils.checkPolicyForUnique(model, args, 'update', db, checkArgs);
                         // register post-update check
                         yield _registerPostUpdateCheck(model, args);
                     }
@@ -663,15 +664,15 @@ class PolicyProxyHandler {
                 update: (model, args, context) => __awaiter(this, void 0, void 0, function* () {
                     var _c;
                     // build a unique query including upstream conditions
-                    const uniqueFilter = this.utils.buildReversedQuery(context);
+                    const uniqueFilter = this.policyUtils.buildReversedQuery(context);
                     // handle not-found
-                    const existing = yield this.utils.checkExistence(db, model, uniqueFilter, true);
+                    const existing = yield this.policyUtils.checkExistence(db, model, uniqueFilter, true);
                     // check if the update actually writes to this model
                     let thisModelUpdate = false;
                     const updatePayload = (_c = args.data) !== null && _c !== void 0 ? _c : args;
                     const validatedPayload = this.validateUpdateInputSchema(model, updatePayload);
                     if (validatedPayload !== updatePayload) {
-                        this.utils.replace(updatePayload, validatedPayload);
+                        this.policyUtils.replace(updatePayload, validatedPayload);
                     }
                     if (updatePayload) {
                         for (const key of Object.keys(updatePayload)) {
@@ -691,11 +692,11 @@ class PolicyProxyHandler {
                         }
                     }
                     if (thisModelUpdate) {
-                        this.utils.tryReject(db, this.model, 'update');
+                        this.policyUtils.tryReject(db, this.model, 'update');
                         // check pre-update guard
-                        yield this.utils.checkPolicyForUnique(model, uniqueFilter, 'update', db, args);
+                        yield this.policyUtils.checkPolicyForUnique(model, uniqueFilter, 'update', db, args);
                         // handles the case where id fields are updated
-                        const ids = this.utils.clone(existing);
+                        const ids = this.policyUtils.clone(existing);
                         for (const key of Object.keys(existing)) {
                             const updateValue = args.data ? args.data[key] : args[key];
                             if (typeof updateValue === 'string' ||
@@ -710,15 +711,15 @@ class PolicyProxyHandler {
                 }),
                 updateMany: (model, args, context) => __awaiter(this, void 0, void 0, function* () {
                     // prepare for post-update check
-                    if (this.utils.hasAuthGuard(model, 'postUpdate') || this.utils.getZodSchema(model)) {
-                        let select = this.utils.makeIdSelection(model);
-                        const preValueSelect = this.utils.getPreValueSelect(model);
+                    if (this.policyUtils.hasAuthGuard(model, 'postUpdate') || this.policyUtils.getZodSchema(model)) {
+                        let select = this.policyUtils.makeIdSelection(model);
+                        const preValueSelect = this.policyUtils.getPreValueSelect(model);
                         if (preValueSelect) {
                             select = Object.assign(Object.assign({}, select), preValueSelect);
                         }
-                        const reversedQuery = this.utils.buildReversedQuery(context);
+                        const reversedQuery = this.policyUtils.buildReversedQuery(context);
                         const currentSetQuery = { select, where: reversedQuery };
-                        this.utils.injectAuthGuardAsWhere(db, currentSetQuery, model, 'read');
+                        this.policyUtils.injectAuthGuardAsWhere(db, currentSetQuery, model, 'read');
                         if (this.shouldLogQuery) {
                             this.logger.info(`[policy] \`findMany\` for post update check ${model}:\n${(0, utils_1.formatObject)(currentSetQuery)}`);
                         }
@@ -731,16 +732,16 @@ class PolicyProxyHandler {
                         })));
                     }
                     args.data = this.validateUpdateInputSchema(model, args.data);
-                    const updateGuard = this.utils.getAuthGuard(db, model, 'update');
-                    if (this.utils.isTrue(updateGuard) || this.utils.isFalse(updateGuard)) {
+                    const updateGuard = this.policyUtils.getAuthGuard(db, model, 'update');
+                    if (this.policyUtils.isTrue(updateGuard) || this.policyUtils.isFalse(updateGuard)) {
                         // injects simple auth guard into where clause
-                        this.utils.injectAuthGuardAsWhere(db, args, model, 'update');
+                        this.policyUtils.injectAuthGuardAsWhere(db, args, model, 'update');
                     }
                     else {
                         // we have to process `updateMany` separately because the guard may contain
                         // filters using relation fields which are not allowed in nested `updateMany`
-                        const reversedQuery = this.utils.buildReversedQuery(context);
-                        const updateWhere = this.utils.and(reversedQuery, updateGuard);
+                        const reversedQuery = this.policyUtils.buildReversedQuery(context);
+                        const updateWhere = this.policyUtils.and(reversedQuery, updateGuard);
                         if (this.shouldLogQuery) {
                             this.logger.info(`[policy] \`updateMany\` ${model}:\n${(0, utils_1.formatObject)({
                                 where: updateWhere,
@@ -769,13 +770,13 @@ class PolicyProxyHandler {
                 }),
                 upsert: (model, args, context) => __awaiter(this, void 0, void 0, function* () {
                     // build a unique query including upstream conditions
-                    const uniqueFilter = this.utils.buildReversedQuery(context);
+                    const uniqueFilter = this.policyUtils.buildReversedQuery(context);
                     // branch based on if the update target exists
-                    const existing = yield this.utils.checkExistence(db, model, uniqueFilter);
+                    const existing = yield this.policyUtils.checkExistence(db, model, uniqueFilter);
                     if (existing) {
                         // update case
                         // check pre-update guard
-                        yield this.utils.checkPolicyForUnique(model, uniqueFilter, 'update', db, args);
+                        yield this.policyUtils.checkPolicyForUnique(model, uniqueFilter, 'update', db, args);
                         // register post-update check
                         yield _registerPostUpdateCheck(model, uniqueFilter);
                         // convert upsert to update
@@ -800,7 +801,7 @@ class PolicyProxyHandler {
                 connect: (model, args, context) => __awaiter(this, void 0, void 0, function* () { return _connectDisconnect(model, args, context); }),
                 connectOrCreate: (model, args, context) => __awaiter(this, void 0, void 0, function* () {
                     // the where condition is already unique, so we can use it to check if the target exists
-                    const existing = yield this.utils.checkExistence(db, model, args.where);
+                    const existing = yield this.policyUtils.checkExistence(db, model, args.where);
                     if (existing) {
                         // connect
                         yield _connectDisconnect(model, args.where, context);
@@ -813,9 +814,9 @@ class PolicyProxyHandler {
                 disconnect: (model, args, context) => __awaiter(this, void 0, void 0, function* () { return _connectDisconnect(model, args, context); }),
                 set: (model, args, context) => __awaiter(this, void 0, void 0, function* () {
                     // find the set of items to be replaced
-                    const reversedQuery = this.utils.buildReversedQuery(context);
+                    const reversedQuery = this.policyUtils.buildReversedQuery(context);
                     const findCurrSetArgs = {
-                        select: this.utils.makeIdSelection(model),
+                        select: this.policyUtils.makeIdSelection(model),
                         where: reversedQuery,
                     };
                     if (this.shouldLogQuery) {
@@ -829,23 +830,23 @@ class PolicyProxyHandler {
                 }),
                 delete: (model, args, context) => __awaiter(this, void 0, void 0, function* () {
                     // build a unique query including upstream conditions
-                    const uniqueFilter = this.utils.buildReversedQuery(context);
+                    const uniqueFilter = this.policyUtils.buildReversedQuery(context);
                     // handle not-found
-                    yield this.utils.checkExistence(db, model, uniqueFilter, true);
+                    yield this.policyUtils.checkExistence(db, model, uniqueFilter, true);
                     // check delete guard
-                    yield this.utils.checkPolicyForUnique(model, uniqueFilter, 'delete', db, args);
+                    yield this.policyUtils.checkPolicyForUnique(model, uniqueFilter, 'delete', db, args);
                 }),
                 deleteMany: (model, args, context) => __awaiter(this, void 0, void 0, function* () {
-                    const guard = yield this.utils.getAuthGuard(db, model, 'delete');
-                    if (this.utils.isTrue(guard) || this.utils.isFalse(guard)) {
+                    const guard = yield this.policyUtils.getAuthGuard(db, model, 'delete');
+                    if (this.policyUtils.isTrue(guard) || this.policyUtils.isFalse(guard)) {
                         // inject simple auth guard
-                        context.parent.deleteMany = this.utils.and(args, guard);
+                        context.parent.deleteMany = this.policyUtils.and(args, guard);
                     }
                     else {
                         // we have to process `deleteMany` separately because the guard may contain
                         // filters using relation fields which are not allowed in nested `deleteMany`
-                        const reversedQuery = this.utils.buildReversedQuery(context);
-                        const deleteWhere = this.utils.and(reversedQuery, guard);
+                        const reversedQuery = this.policyUtils.buildReversedQuery(context);
+                        const deleteWhere = this.policyUtils.and(reversedQuery, guard);
                         if (this.shouldLogQuery) {
                             this.logger.info(`[policy] \`deleteMany\` ${model}:\n${(0, utils_1.formatObject)({ where: deleteWhere })}`);
                         }
@@ -862,14 +863,14 @@ class PolicyProxyHandler {
             const result = yield db[this.model].update({
                 where: args.where,
                 data: args.data,
-                select: this.utils.makeIdSelection(this.model),
+                select: this.policyUtils.makeIdSelection(this.model),
             });
             return { result, postWriteChecks };
         });
     }
     // Validates the given update payload against Zod schema if any
     validateUpdateInputSchema(model, data) {
-        const schema = this.utils.getZodSchema(model, 'update');
+        const schema = this.policyUtils.getZodSchema(model, 'update');
         if (schema && data) {
             // update payload can contain non-literal fields, like:
             //   { x: { increment: 1 } }
@@ -877,7 +878,7 @@ class PolicyProxyHandler {
             const literalData = Object.entries(data).reduce((acc, [k, v]) => (Object.assign(Object.assign({}, acc), (typeof v !== 'object' ? { [k]: v } : {}))), {});
             const parseResult = schema.safeParse(literalData);
             if (!parseResult.success) {
-                throw this.utils.deniedByPolicy(model, 'update', `input failed validation: ${(0, zod_validation_error_1.fromZodError)(parseResult.error)}`, constants_1.CrudFailureReason.DATA_VALIDATION_VIOLATION, parseResult.error);
+                throw this.policyUtils.deniedByPolicy(model, 'update', `input failed validation: ${(0, zod_validation_error_1.fromZodError)(parseResult.error)}`, constants_1.CrudFailureReason.DATA_VALIDATION_VIOLATION, parseResult.error);
             }
             // schema may have transformed field values, use it to overwrite the original data
             return Object.assign(Object.assign({}, data), parseResult.data);
@@ -886,45 +887,30 @@ class PolicyProxyHandler {
             return data;
         }
     }
-    isUnsafeMutate(model, args) {
-        if (!args) {
-            return false;
-        }
-        for (const k of Object.keys(args)) {
-            const field = (0, cross_1.resolveField)(this.modelMeta, model, k);
-            if (this.isAutoIncrementIdField(field) || (field === null || field === void 0 ? void 0 : field.isForeignKey)) {
-                return true;
-            }
-        }
-        return false;
-    }
-    isAutoIncrementIdField(field) {
-        return field.isId && field.isAutoIncrement;
-    }
     updateMany(args) {
         return __awaiter(this, void 0, void 0, function* () {
             if (!args) {
-                throw (0, utils_1.prismaClientValidationError)(this.prisma, 'query argument is required');
+                throw (0, utils_1.prismaClientValidationError)(this.prisma, this.prismaModule, 'query argument is required');
             }
             if (!args.data) {
-                throw (0, utils_1.prismaClientValidationError)(this.prisma, 'data field is required in query argument');
+                throw (0, utils_1.prismaClientValidationError)(this.prisma, this.prismaModule, 'data field is required in query argument');
             }
-            this.utils.tryReject(this.prisma, this.model, 'update');
-            args = this.utils.clone(args);
-            this.utils.injectAuthGuardAsWhere(this.prisma, args, this.model, 'update');
+            this.policyUtils.tryReject(this.prisma, this.model, 'update');
+            args = this.policyUtils.clone(args);
+            this.policyUtils.injectAuthGuardAsWhere(this.prisma, args, this.model, 'update');
             args.data = this.validateUpdateInputSchema(this.model, args.data);
-            if (this.utils.hasAuthGuard(this.model, 'postUpdate') || this.utils.getZodSchema(this.model)) {
+            if (this.policyUtils.hasAuthGuard(this.model, 'postUpdate') || this.policyUtils.getZodSchema(this.model)) {
                 // use a transaction to do post-update checks
                 const postWriteChecks = [];
-                return this.transaction((tx) => __awaiter(this, void 0, void 0, function* () {
+                return this.queryUtils.transaction(this.prisma, (tx) => __awaiter(this, void 0, void 0, function* () {
                     // collect pre-update values
-                    let select = this.utils.makeIdSelection(this.model);
-                    const preValueSelect = this.utils.getPreValueSelect(this.model);
+                    let select = this.policyUtils.makeIdSelection(this.model);
+                    const preValueSelect = this.policyUtils.getPreValueSelect(this.model);
                     if (preValueSelect) {
                         select = Object.assign(Object.assign({}, select), preValueSelect);
                     }
                     const currentSetQuery = { select, where: args.where };
-                    this.utils.injectAuthGuardAsWhere(tx, currentSetQuery, this.model, 'read');
+                    this.policyUtils.injectAuthGuardAsWhere(tx, currentSetQuery, this.model, 'read');
                     if (this.shouldLogQuery) {
                         this.logger.info(`[policy] \`findMany\` ${this.model}: ${(0, utils_1.formatObject)(currentSetQuery)}`);
                     }
@@ -932,7 +918,7 @@ class PolicyProxyHandler {
                     postWriteChecks.push(...currentSet.map((preValue) => ({
                         model: this.model,
                         operation: 'postUpdate',
-                        uniqueFilter: this.utils.getEntityIds(this.model, preValue),
+                        uniqueFilter: this.policyUtils.getEntityIds(this.model, preValue),
                         preValue: preValueSelect ? preValue : undefined,
                     })));
                     // proceed with the update
@@ -954,36 +940,36 @@ class PolicyProxyHandler {
     upsert(args) {
         return __awaiter(this, void 0, void 0, function* () {
             if (!args) {
-                throw (0, utils_1.prismaClientValidationError)(this.prisma, 'query argument is required');
+                throw (0, utils_1.prismaClientValidationError)(this.prisma, this.prismaModule, 'query argument is required');
             }
             if (!args.where) {
-                throw (0, utils_1.prismaClientValidationError)(this.prisma, 'where field is required in query argument');
+                throw (0, utils_1.prismaClientValidationError)(this.prisma, this.prismaModule, 'where field is required in query argument');
             }
             if (!args.create) {
-                throw (0, utils_1.prismaClientValidationError)(this.prisma, 'create field is required in query argument');
+                throw (0, utils_1.prismaClientValidationError)(this.prisma, this.prismaModule, 'create field is required in query argument');
             }
             if (!args.update) {
-                throw (0, utils_1.prismaClientValidationError)(this.prisma, 'update field is required in query argument');
+                throw (0, utils_1.prismaClientValidationError)(this.prisma, this.prismaModule, 'update field is required in query argument');
             }
-            this.utils.tryReject(this.prisma, this.model, 'create');
-            this.utils.tryReject(this.prisma, this.model, 'update');
-            args = this.utils.clone(args);
+            this.policyUtils.tryReject(this.prisma, this.model, 'create');
+            this.policyUtils.tryReject(this.prisma, this.model, 'update');
+            args = this.policyUtils.clone(args);
             // We can call the native "upsert" because we can't tell if an entity was created or updated
             // for doing post-write check accordingly. Instead, decompose it into create or update.
-            const { result, error } = yield this.transaction((tx) => __awaiter(this, void 0, void 0, function* () {
+            const { result, error } = yield this.queryUtils.transaction(this.prisma, (tx) => __awaiter(this, void 0, void 0, function* () {
                 const { where, create, update } = args, rest = __rest(args, ["where", "create", "update"]);
-                const existing = yield this.utils.checkExistence(tx, this.model, args.where);
+                const existing = yield this.policyUtils.checkExistence(tx, this.model, args.where);
                 if (existing) {
                     // update case
                     const { result, postWriteChecks } = yield this.doUpdate(Object.assign({ where, data: update }, rest), tx);
                     yield this.runPostWriteChecks(postWriteChecks, tx);
-                    return this.utils.readBack(tx, this.model, 'update', args, result);
+                    return this.policyUtils.readBack(tx, this.model, 'update', args, result);
                 }
                 else {
                     // create case
                     const { result, postWriteChecks } = yield this.doCreate(this.model, Object.assign({ data: create }, rest), tx);
                     yield this.runPostWriteChecks(postWriteChecks, tx);
-                    return this.utils.readBack(tx, this.model, 'create', args, result);
+                    return this.policyUtils.readBack(tx, this.model, 'create', args, result);
                 }
             }));
             if (error) {
@@ -1001,21 +987,21 @@ class PolicyProxyHandler {
     delete(args) {
         return __awaiter(this, void 0, void 0, function* () {
             if (!args) {
-                throw (0, utils_1.prismaClientValidationError)(this.prisma, 'query argument is required');
+                throw (0, utils_1.prismaClientValidationError)(this.prisma, this.prismaModule, 'query argument is required');
             }
             if (!args.where) {
-                throw (0, utils_1.prismaClientValidationError)(this.prisma, 'where field is required in query argument');
+                throw (0, utils_1.prismaClientValidationError)(this.prisma, this.prismaModule, 'where field is required in query argument');
             }
-            this.utils.tryReject(this.prisma, this.model, 'delete');
-            const { result, error } = yield this.transaction((tx) => __awaiter(this, void 0, void 0, function* () {
+            this.policyUtils.tryReject(this.prisma, this.model, 'delete');
+            const { result, error } = yield this.queryUtils.transaction(this.prisma, (tx) => __awaiter(this, void 0, void 0, function* () {
                 // do a read-back before delete
-                const r = yield this.utils.readBack(tx, this.model, 'delete', args, args.where);
+                const r = yield this.policyUtils.readBack(tx, this.model, 'delete', args, args.where);
                 const error = r.error;
                 const read = r.result;
                 // check existence
-                yield this.utils.checkExistence(tx, this.model, args.where, true);
+                yield this.policyUtils.checkExistence(tx, this.model, args.where, true);
                 // inject delete guard
-                yield this.utils.checkPolicyForUnique(this.model, args.where, 'delete', tx, args);
+                yield this.policyUtils.checkPolicyForUnique(this.model, args.where, 'delete', tx, args);
                 // proceed with the deletion
                 if (this.shouldLogQuery) {
                     this.logger.info(`[policy] \`delete\` ${this.model}:\n${(0, utils_1.formatObject)(args)}`);
@@ -1033,10 +1019,10 @@ class PolicyProxyHandler {
     }
     deleteMany(args) {
         return __awaiter(this, void 0, void 0, function* () {
-            this.utils.tryReject(this.prisma, this.model, 'delete');
+            this.policyUtils.tryReject(this.prisma, this.model, 'delete');
             // inject policy conditions
             args = args !== null && args !== void 0 ? args : {};
-            this.utils.injectAuthGuardAsWhere(this.prisma, args, this.model, 'delete');
+            this.policyUtils.injectAuthGuardAsWhere(this.prisma, args, this.model, 'delete');
             // conduct the deletion
             if (this.shouldLogQuery) {
                 this.logger.info(`[policy] \`deleteMany\` ${this.model}:\n${(0, utils_1.formatObject)(args)}`);
@@ -1049,11 +1035,11 @@ class PolicyProxyHandler {
     aggregate(args) {
         return __awaiter(this, void 0, void 0, function* () {
             if (!args) {
-                throw (0, utils_1.prismaClientValidationError)(this.prisma, 'query argument is required');
+                throw (0, utils_1.prismaClientValidationError)(this.prisma, this.prismaModule, 'query argument is required');
             }
-            args = this.utils.clone(args);
+            args = this.policyUtils.clone(args);
             // inject policy conditions
-            this.utils.injectAuthGuardAsWhere(this.prisma, args, this.model, 'read');
+            this.policyUtils.injectAuthGuardAsWhere(this.prisma, args, this.model, 'read');
             if (this.shouldLogQuery) {
                 this.logger.info(`[policy] \`aggregate\` ${this.model}:\n${(0, utils_1.formatObject)(args)}`);
             }
@@ -1063,11 +1049,11 @@ class PolicyProxyHandler {
     groupBy(args) {
         return __awaiter(this, void 0, void 0, function* () {
             if (!args) {
-                throw (0, utils_1.prismaClientValidationError)(this.prisma, 'query argument is required');
+                throw (0, utils_1.prismaClientValidationError)(this.prisma, this.prismaModule, 'query argument is required');
             }
-            args = this.utils.clone(args);
+            args = this.policyUtils.clone(args);
             // inject policy conditions
-            this.utils.injectAuthGuardAsWhere(this.prisma, args, this.model, 'read');
+            this.policyUtils.injectAuthGuardAsWhere(this.prisma, args, this.model, 'read');
             if (this.shouldLogQuery) {
                 this.logger.info(`[policy] \`groupBy\` ${this.model}:\n${(0, utils_1.formatObject)(args)}`);
             }
@@ -1077,8 +1063,8 @@ class PolicyProxyHandler {
     count(args) {
         return __awaiter(this, void 0, void 0, function* () {
             // inject policy conditions
-            args = args ? this.utils.clone(args) : {};
-            this.utils.injectAuthGuardAsWhere(this.prisma, args, this.model, 'read');
+            args = args ? this.policyUtils.clone(args) : {};
+            this.policyUtils.injectAuthGuardAsWhere(this.prisma, args, this.model, 'read');
             if (this.shouldLogQuery) {
                 this.logger.info(`[policy] \`count\` ${this.model}:\n${(0, utils_1.formatObject)(args)}`);
             }
@@ -1089,8 +1075,8 @@ class PolicyProxyHandler {
     //#region Subscribe (Prisma Pulse)
     subscribe(args) {
         return __awaiter(this, void 0, void 0, function* () {
-            const readGuard = this.utils.getAuthGuard(this.prisma, this.model, 'read');
-            if (this.utils.isTrue(readGuard)) {
+            const readGuard = this.policyUtils.getAuthGuard(this.prisma, this.model, 'read');
+            if (this.policyUtils.isTrue(readGuard)) {
                 // no need to inject
                 if (this.shouldLogQuery) {
                     this.logger.info(`[policy] \`subscribe\` ${this.model}:\n${(0, utils_1.formatObject)(args)}`);
@@ -1103,25 +1089,25 @@ class PolicyProxyHandler {
             }
             else {
                 if (typeof args !== 'object') {
-                    throw (0, utils_1.prismaClientValidationError)(this.prisma, 'argument must be an object');
+                    throw (0, utils_1.prismaClientValidationError)(this.prisma, this.prismaModule, 'argument must be an object');
                 }
                 if (Object.keys(args).length === 0) {
                     // include all
                     args = { create: {}, update: {}, delete: {} };
                 }
                 else {
-                    args = this.utils.clone(args);
+                    args = this.policyUtils.clone(args);
                 }
             }
             // inject into subscribe conditions
             if (args.create) {
-                args.create.after = this.utils.and(args.create.after, readGuard);
+                args.create.after = this.policyUtils.and(args.create.after, readGuard);
             }
             if (args.update) {
-                args.update.after = this.utils.and(args.update.after, readGuard);
+                args.update.after = this.policyUtils.and(args.update.after, readGuard);
             }
             if (args.delete) {
-                args.delete.before = this.utils.and(args.delete.before, readGuard);
+                args.delete.before = this.policyUtils.and(args.delete.before, readGuard);
             }
             if (this.shouldLogQuery) {
                 this.logger.info(`[policy] \`subscribe\` ${this.model}:\n${(0, utils_1.formatObject)(args)}`);
@@ -1135,33 +1121,13 @@ class PolicyProxyHandler {
         var _a;
         return !!((_a = this.options) === null || _a === void 0 ? void 0 : _a.logPrismaQuery) && this.logger.enabled('info');
     }
-    transaction(action) {
-        var _a, _b, _c;
-        if (this.prisma['$transaction']) {
-            const txOptions = { maxWait: this.DEFAULT_TX_MAXWAIT, timeout: this.DEFAULT_TX_TIMEOUT };
-            if (((_a = this.options) === null || _a === void 0 ? void 0 : _a.transactionMaxWait) !== undefined) {
-                txOptions.maxWait = this.options.transactionMaxWait;
-            }
-            if (((_b = this.options) === null || _b === void 0 ? void 0 : _b.transactionTimeout) !== undefined) {
-                txOptions.timeout = this.options.transactionTimeout;
-            }
-            if (((_c = this.options) === null || _c === void 0 ? void 0 : _c.transactionIsolationLevel) !== undefined) {
-                txOptions.isolationLevel = this.options.transactionIsolationLevel;
-            }
-            return this.prisma.$transaction((tx) => action(tx), txOptions);
-        }
-        else {
-            // already in transaction, don't nest
-            return action(this.prisma);
-        }
-    }
     runPostWriteChecks(postWriteChecks, db) {
         return __awaiter(this, void 0, void 0, function* () {
-            yield Promise.all(postWriteChecks.map(({ model, operation, uniqueFilter, preValue }) => __awaiter(this, void 0, void 0, function* () { return this.utils.checkPolicyForUnique(model, uniqueFilter, operation, db, undefined, preValue); })));
+            yield Promise.all(postWriteChecks.map(({ model, operation, uniqueFilter, preValue }) => __awaiter(this, void 0, void 0, function* () { return this.policyUtils.checkPolicyForUnique(model, uniqueFilter, operation, db, undefined, preValue); })));
         });
     }
     makeHandler(model) {
-        return new PolicyProxyHandler(this.prisma, this.policy, this.modelMeta, this.zodSchemas, model, this.user, this.options);
+        return new PolicyProxyHandler(this.prisma, model, this.options, this.context);
     }
     requireBackLink(fieldInfo) {
         (0, tiny_invariant_1.default)(fieldInfo.backLink, `back link not found for field ${fieldInfo.name}`);